Twitter fixes cross-site scripting vulnerability

Twitter has fixed a cross-site scripting (XSS) vulnerability that stole a user's cookie to distribute compromised links.

It was detected by Stefan Tanase, senior security researcher at Kaspersky Lab. He said that the exploit steals the cookie of the Twitter user, which is transferred to two specific servers, and essentially any account that clicked on the malicious links is compromised.

He said that the bit.ly statistics for one of the malicious links show that more than 100,000 users clicked on the link.

“All clues point to Brazil as the originating country for this attack. First, the two domain names used to get the stolen cookies are registered under Brazilian names. More than that, one of them is actually also hosted in Brazil,” he said.

One of the links was a short tweet in Portuguese about the Brazilian pop band Restart, reportedly suffering a 'tragic accident'. Tanase said there is not much doubt about the origins of this attack.

The malicious scripts were detected by Kaspersky Lab as Exploit.JS.Twetti.a, and it has blacklisted the URLs used in this attack.

Tanase said: “We are currently working on taking down the malicious URLs and minimising the damage as much as possible. Twitter along with other significant industry peers has of course been notified.”

Twitter commented that the vulnerability is now fixed.

See original article on scmagazineus.com