Twitter has fixed a cross-site scripting (XSS) vulnerability that stole a user's cookie to distribute compromised links.
It was detected by Stefan Tanase, senior security researcher at Kaspersky Lab. He said that the exploit steals the cookie of the Twitter user, which is transferred to two specific servers, and essentially any account that clicked on the malicious links is compromised.
He said that the bit.ly statistics for one of the malicious links show that more than 100,000 users clicked on the link.
“All clues point to Brazil as the originating country for this attack. First, the two domain names used to get the stolen cookies are registered under Brazilian names. More than that, one of them is actually also hosted in Brazil,” he said.
One of the links was a short tweet in Portuguese about the Brazilian pop band Restart, reportedly suffering a 'tragic accident'. Tanase said there is not much doubt about the origins of this attack.
The malicious scripts were detected by Kaspersky Lab as Exploit.JS.Twetti.a, and it has blacklisted the URLs used in this attack.
Tanase said: “We are currently working on taking down the malicious URLs and minimising the damage as much as possible. Twitter along with other significant industry peers has of course been notified.”
Twitter commented that the vulnerability is now fixed.
See original article on scmagazineus.com
Twitter fixes cross-site scripting vulnerability
Exploit stole a user's cookie to distribute compromised links.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers

Modern Identity for SAP and Beyond: Replace SAP IDM with Saviynt

Saviynt Simplifies GRC and Access Control for SAP and Beyond
_page-0001.jpg&w=100&c=1&s=0)
Futureproof Your Business with Datacom and AMD: Seamless Windows 11 Transition

See everything. Do more.

Lindentech Secures Digital Identity with Zero Trust and Microsoft Entra