Loading HuntDB...

Improper santization of edit in list feature at twitter leads to delete any twitter user's list cover photo.

Medium
X
X (Formerly Twitter)
Submitted None

Team Summary

Official summary from X (Formerly Twitter)

An attacker could delete a victim’s public List banner image by setting the mediaId to the same mediaId of an existing banner image, and then removing the banner image. This ultimately deleted the victim’s banner image, which violates access controls in place that restrict unauthorized users from editing another user’s lists.

Reported by greytesla

Vulnerability Details

Technical details and impact analysis

Insecure Direct Object Reference (IDOR)
Summary: Improper santization of edit list feature at twitter leads to delete any twitter user's list cover photo. from this bug attacker can delete any twitter users list's cover photo. Description: Improper santization of edit in list feature at twitter leads to delete any twitter user's list cover photo. from this bug attacker can delete any twitter users list's cover photo. as changing a media id in attackers request makes two entity referring to single photo so when attacker deletes his cover photo automatically the media related to that gets deleted so victims cover photo also gets deleted ## Steps To Reproduce: Step 1: gain media-id(for cover photo of list) of victim easily accessible by visiting list on victims profile. Step 2: now from attackers account create a list and change cover photo, intercept the request and change the media id to victims cover photo id. Step 3 : after that delete list's cover photo from attackers account it will automatically delete victim list's cover photo . ## Impact: Security Impact : attacker can delete any twitter users list's cover photo. ## Supporting Material/References: POC Attached Below * List any additional material (e.g. screenshots, logs, etc.) ## Impact Security Impact : attacker can delete any twitter users list's cover photo.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$560.00

Submitted

Weakness

Insecure Direct Object Reference (IDOR)