Thursday, July 2, 2009

MoTB #03: TwitWall Persistent XSS

What is TwitWall
"TwitWall is the easy-to-use, quick-to-blast-out, instant blog companion for Twitter. With TwitWall, you can embed your favorite videos and widgets, upload your photos, mp3 music or podcasts, - you name it.." (TwitWall home page)


Twitter affect
TwitWall can be used to send tweets and follow/unfollow other Twitter users.
TwitWall is using OAuth authentication token in order to utilize the Twitter API.


Popularity rate
Though it's here since Summer 2008, it has yet to gain enough user base to get into any of the top twitter services lists - 0.5 twits


Vulnerability: Persistent Cross-Site in TwitWall entry view page.
Status: Patched.
Details: TwitWall allows HTML to be embedded in the wall entries. According to the vendor this was done because "our users with non-malicious intentions enjoy using our html editor". Unfortunately, the entry view page does not santize scripts and events that came along with the HTML.



Vendor response rate
Vulnerability was fully fixed 20 hours after it has been reported.