<story><title>Twitter &apos;onmouseover&apos; security flaw widely exploited</title><url>http://www.sophos.com/blogs/gc/g/2010/09/21/twitter-onmouseover-security-flaw-widely-exploited/</url></story><parent_chain><item><author>bl4k</author><text>I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.&lt;p&gt;Reminds me of the MySpace worm that took the site down&lt;p&gt;Time to change your passwords!&lt;p&gt;(Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie. $() to grab an element), url shorteners and ability to include external JS mean that you can do almost anything in the 140 char payload.&lt;p&gt;Explainer:&lt;p&gt;The vulnerability is because URL&apos;s are not being escaped properly. For eg. the following URL is posted to Twitter:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  http://thisisatest.com/@&quot;onmouseover=&quot;alert(&apos;test xss&apos;)&quot;/
&lt;/code&gt;&lt;/pre&gt;
Twitter treats this as the URL. When it is parsed Twitter wraps a link around that code, so the HTML now looks like:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;#60;a href=&quot;http://thisisatest.com/@&quot;onmouseover=&quot;alert(&apos;test xss&apos;)&quot;rel/&quot; target=&quot;_blank&quot; =&quot;&quot;&amp;#62;http://thisisatest.com/@&quot;onmouseover=&quot;alert(&apos;test xss&apos;)&quot;/&amp;#60;/a&amp;#62;&amp;#60;/span&amp;#62; 
&lt;/code&gt;&lt;/pre&gt;
You can see that by putting in the URL and the trailing slash, Twitter thinks it has a valid URL even though it contains a quote mark in it which allows it to escape the URL attribute and include a mouse over. You can write anything to the page, including closing the link and including a script element.&lt;p&gt;You don&apos;t have to use onmouseover. You could close the link and then insert some external javascript that can re-write your tweet to make it look innocent (or hide that entire tweet), then attach a mousemove event to the body document. This means you could propagate a worm silently and without requiring a mouseover on the actual tweet.&lt;p&gt;(edit: pretty concerned about the number of people here who think that being able to inject javascript on a site in the context of a users session is not a big deal)</text></item></parent_chain><comment><author>Tichy</author><text>What is the significance of the &quot;@&quot;? Is it because once they encounter the @, they split into a different parsing routine (for example to link @replies)?</text></comment>
<story><title>Twitter &apos;onmouseover&apos; security flaw widely exploited</title><url>http://www.sophos.com/blogs/gc/g/2010/09/21/twitter-onmouseover-security-flaw-widely-exploited/</url></story><parent_chain><item><author>bl4k</author><text>I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.&lt;p&gt;Reminds me of the MySpace worm that took the site down&lt;p&gt;Time to change your passwords!&lt;p&gt;(Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie. $() to grab an element), url shorteners and ability to include external JS mean that you can do almost anything in the 140 char payload.&lt;p&gt;Explainer:&lt;p&gt;The vulnerability is because URL&apos;s are not being escaped properly. For eg. the following URL is posted to Twitter:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  http://thisisatest.com/@&quot;onmouseover=&quot;alert(&apos;test xss&apos;)&quot;/
&lt;/code&gt;&lt;/pre&gt;
Twitter treats this as the URL. When it is parsed Twitter wraps a link around that code, so the HTML now looks like:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;#60;a href=&quot;http://thisisatest.com/@&quot;onmouseover=&quot;alert(&apos;test xss&apos;)&quot;rel/&quot; target=&quot;_blank&quot; =&quot;&quot;&amp;#62;http://thisisatest.com/@&quot;onmouseover=&quot;alert(&apos;test xss&apos;)&quot;/&amp;#60;/a&amp;#62;&amp;#60;/span&amp;#62; 
&lt;/code&gt;&lt;/pre&gt;
You can see that by putting in the URL and the trailing slash, Twitter thinks it has a valid URL even though it contains a quote mark in it which allows it to escape the URL attribute and include a mouse over. You can write anything to the page, including closing the link and including a script element.&lt;p&gt;You don&apos;t have to use onmouseover. You could close the link and then insert some external javascript that can re-write your tweet to make it look innocent (or hide that entire tweet), then attach a mousemove event to the body document. This means you could propagate a worm silently and without requiring a mouseover on the actual tweet.&lt;p&gt;(edit: pretty concerned about the number of people here who think that being able to inject javascript on a site in the context of a users session is not a big deal)</text></item></parent_chain><comment><author>jasondavies</author><text>Is it really necessary to change one&apos;s password? I&apos;ve logged out and logged in again to make sure I invalidated my old session cookie. Hopefully that&apos;s sufficient.</text></comment>