Twitter fixes XSS flaw after being exploited

Share this article:
Cybercriminals this week took advantage of a cross-site scripting (XSS) vulnerability on Twitter that since has been fixed, according to security researchers.

A malicious JavaScript payload distributed on Twitter took advantage of the XSS flaw to steal users' session cookies and send them to two attacker-controlled servers, Stefan Tanase, security researcher for anti-virus firm Kaspersky, wrote in a blog post Tuesday. The malicious payload was being distributed via malicious links included in tweets.

Written in Portuguese, the malicious tweet claimed that Brazilian pop band Restart had suffered a “tragic accident.”

Simply clicking on one of the shortened links caused a user's account to be compromised. Web statistics from URL redirection service indicate that one of the links used in the attack was clicked more than 116,000 times. 

Based on the content of the tweet, researchers believe the attack originated from Brazil. Moreover, the domains used in the attack were registered under Brazilian names and one of them was hosted in the South American country.

Twitter fixed the vulnerability shortly after attackers began exploiting it, according to Kaspersky. Additionally, Twitter reset passwords belonging to individuals who appeared to have been affected, a company spokeswoman told on Wednesday

The flaw, which affected the Twitter developer platform search field, was first disclosed on July 29 by a researcher using the handle “cbr,” according to the XSSed project, an online archive of XSS flaws.

Earlier this week, Mike Bailey, senior security researcher at vulnerability assessment and testing firm MAD Security, released a proof-of-concept on Twitter that exploited the vulnerability. When clicked, the demonstration caused users to Tweet "@mckt_ (Bailey's Twitter handle) just compromised my Twitter account with XSS. #twitterXSS.”

“These things are ridiculously easy to attack,” Bailey wrote. “While this demo requires interaction, it doesn't have to. The entire attack could just as easily be completely silent.”

Over the summer, bug hunters reported at least three other XSS vulnerabilities on Twitter, all of which were quickly fixed, according to the XSSed project.

Share this article:

Sign up to our newsletters

More in News

Hackers target video game companies to lift copy protections and develop cheats

A threat group is targeting video game companies in order to lift DRM protections, develop cheats and possibly to steal source code.

Android malware spreads via mail tracking SMS spam

The mobile malware is currently targeting German users, McAfee revealed.

About 2,800 victims of worldwide info-stealing campaign targeting various sectors

About 2,800 victims of worldwide info-stealing campaign targeting ...

Unknown attackers have claimed about 2,800 victims in an ongoing information-stealing campaign identified by Kaspersky Lab as "Crouching Yeti."