Mastodon Feed
Reblogged by slightlyoff@toot.cafe ("Alex Russell"):
molly0xfff@hachyderm.io ("Molly White") wrote:
twitter not paying whitehats. what could go wrong?
this one recently disclosed a vulnerability that would have allowed people to gain control of the twitter accounts of users who merely clicked malicious links
Attachments:
- Chaofan Shou @shoucccc 18h I built a nuclear-weapon-level Twitter/X exploit based on a few previously unfixed vulnerabilities. It is not eligible for bug bounty so I will disclose it soon. @X @elonmusk Chaofan Shou @shoucccc 13h Credit to @rabbit_2333 for the XSS (remote)
- Chaofan Shou @shoucccc 10h And we got the full JS exploit to chain with this XSS vulnerability! In another word, visiting this link earlier today would take over your account: Chaofan Shou @shoucccc 10h It is highly irresponsible for Twitter to ignore these security issues and not pay the whitehats. The architecture and design patterns also need to be corrected. (remote)
- x_austin X (Formerly Twitter) staff closed the report and changed the status to Resolved. Updated 6 hours ago X (Formerly Twitter) has decided that this report is not eligible for a bounty. 6 hours ago No award due to program ban (remote)
- rabbit @rabbit_2333 I submitted this bug report and didn't receive a bounty. You told me that this bug has existed for a year. Seeing that you haven't fixed it for so long, it seems that this bug is not important, so I made it public. Screenshot of conversation from HackerOne: x_austin X (Formerly Twitter) staff posted a comment. a minute ago @rabbit2333 why are you publicly disclosing security issues instead of submitting them to our bug bounty program? Would you mind deleting this post? This is something we're aware of and are addressing. Image F2918855: image.png 26.90 KIB (remote)
