Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domain
Low
X
X (Formerly Twitter)
Submitted None
Actions:
Reported by
mr_edwards
Vulnerability Details
Technical details and impact analysis
##Summary:
There is wrong interpretation of URL encoded characters at `https://twitter.com/safety/unsafe_link_warning` endpoint which could lead to different location then what is supposed to.
Although it shows warning but doesn't show warning about punny code characters.
##Description:
On following characters:
```
%E2%80%AE - RTLO Character
%E2%80%8E - LEFT-TO-RIGHT MARK
%E2%80%91 - Non breaking hyphen
%E2%80%A9 - PARAGRAPH SEPARATOR
%E2%80%AA 0 Right-to-left embedding
```
Interpretation of these characters is different but when we click continue button it will redirect you to some other location.
## Steps To Reproduce:
1. Go to following URL: https://twitter.com/safety/unsafe_link_warning?unsafe_link=https%3A%2F%2F%E2%80%AEmoc.rettiwt
2. You will see that its showing : https://twitter.com
{F522041}
But originally you will be redirected to https://xn--moc-4t7s.rettiwt/ when you click continue button.
##Argument:
> But it is not possible to have TLD 'rettiwt'.
* counter:
We can have URL as follows:
```
https://twitter.com/safety/unsafe_link_warning?unsafe_link=https%3A%2F%2F%E2%80%AEmoc.rettiwt.com
```
{F522042}
## Supporting Material/References:
* screenshots.
## Impact
Wrong location redirection.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$560.00
Submitted
Weakness
Open Redirect