Improper santization of edit in list feature at twitter leads to delete any twitter user's list cover photo.
Medium
X
X (Formerly Twitter)
Submitted None
Team Summary
Official summary from X (Formerly Twitter)
An attacker could delete a victim’s public List banner image by setting the mediaId to the same mediaId of an existing banner image, and then removing the banner image. This ultimately deleted the victim’s banner image, which violates access controls in place that restrict unauthorized users from editing another user’s lists.
Actions:
Reported by
greytesla
Vulnerability Details
Technical details and impact analysis
Summary:
Improper santization of edit list feature at twitter leads to delete any twitter user's list cover photo.
from this bug attacker can delete any twitter users list's cover photo.
Description:
Improper santization of edit in list feature at twitter leads to delete any twitter user's list cover photo.
from this bug attacker can delete any twitter users list's cover photo.
as changing a media id in attackers request makes two entity referring to single photo so when attacker deletes his cover photo automatically the media related to that gets deleted so victims cover photo also gets deleted
## Steps To Reproduce:
Step 1: gain media-id(for cover photo of list) of victim easily accessible by visiting list on victims profile.
Step 2: now from attackers account create a list and change cover photo, intercept the request and change the media id to victims cover photo id.
Step 3 : after that delete list's cover photo from attackers account it will automatically delete victim list's cover photo .
## Impact:
Security Impact : attacker can delete any twitter users list's cover photo.
## Supporting Material/References:
POC Attached Below
* List any additional material (e.g. screenshots, logs, etc.)
## Impact
Security Impact : attacker can delete any twitter users list's cover photo.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$560.00
Submitted
Weakness
Insecure Direct Object Reference (IDOR)