Twitter 'onmouseover' security flaw widely exploited
I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.<p>Reminds me of the MySpace worm that took the site down<p>Time to change your passwords!<p>(Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie. $() to grab an element), url shorteners and ability to include external JS mean that you can do almost anything in the 140 char payload.<p>Explainer:<p>The vulnerability is because URL's are not being escaped properly. For eg. the following URL is posted to Twitter:<p><pre><code>  http://thisisatest.com/@"onmouseover="alert('test xss')"/
</code></pre>
Twitter treats this as the URL. When it is parsed Twitter wraps a link around that code, so the HTML now looks like:<p><pre><code>  <a href="http://thisisatest.com/@"onmouseover="alert('test xss')"rel/" target="_blank" ="">http://thisisatest.com/@"onmouseover="alert('test xss')"/</a></span> 
</code></pre>
You can see that by putting in the URL and the trailing slash, Twitter thinks it has a valid URL even though it contains a quote mark in it which allows it to escape the URL attribute and include a mouse over. You can write anything to the page, including closing the link and including a script element.<p>You don't have to use onmouseover. You could close the link and then insert some external javascript that can re-write your tweet to make it look innocent (or hide that entire tweet), then attach a mousemove event to the body document. This means you could propagate a worm silently and without requiring a mouseover on the actual tweet.<p>(edit: pretty concerned about the number of people here who think that being able to inject javascript on a site in the context of a users session is not a big deal)