ID H1:191380 Type hackerone Reporter seifelsallamy Modified 2017-07-05T23:54:50
Description
Hey,
[1] CRLF:
It's similar to #52042 but weaker
to reproduce go to:
https://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC
you will find that test cookie with the value test has been added to your cookies
[2] XSS:
XSS can occur by injecting a .jpg image
and uploading it to twitter
then changing the extension from .jpg to .html
to reproduce open messages and start a conversation
upload this image F143743 and send it in the conversation
open the image source url it will look alike
remove the last part :large
and put %23.html
XSS popup box will popup
however this image can only appear to you and to the one who you send it to because it is a private message
and to send the message you have to follow the victim and the victim has to follow you in most cases
and ton.twitter.com has no valuable cookies at all
so the impact will be a phishing page or let the victim downloading a malicious software after sending the injected image on a message
CRLF + XSS:
both bugs separately are too weak
but by joining them together the impact will be much more powerful
ton.twitter.com showing the image to the one who has a valid auth_token cookie with a value that has the right to see the injected image
as example the attackers' auth_token is valid and has the right to see the injected image
so if the attacker injected his own auth_token to the victim by CRLF
the injected image will appear to the victim even if the victim not following you
causing a XSS to occur
the following URL will:
[1] change auth_token value to my own auth_token value to make the injected image appear in your pc
[2] will redirect you to the injected imaged
[3] Javascript will be executed causing attacker's phishing page to appear
https://ton.twitter.com/1.1/ton/data/dm/809353163740483587/809353151434330112/O5hEYiOt.jpg%2523.html%E5%98%8A%E5%98%8Dset-cookie%3A%20auth_token%3Db2868e3d5fd901a1cf4819afd147ee893f331294%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC%3BSecure%3BHTTPOnly
Impacts
[1] phishing
[2] crlf injection (cookie injection & DOS may occur & cache poisoning )
[3] under certain circumstances it may lead to bypassing CSP in https://twitter.com
POCS
F143759
F143760
F143761
Thank you!
{"id": "H1:191380", "bulletinFamily": "bugbounty", "title": "Twitter: CRLF and XSS stored on ton.twitter.com", "description": "Hey,\n\n###[1] CRLF:\nIt's similar to #52042 but weaker\nto reproduce go to:\nhttps://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC\n\nyou will find that `test` cookie with the value `test` has been added to your cookies\n\n###[2] XSS:\nXSS can occur by injecting a `.jpg` image \nand uploading it to twitter\nthen changing the extension from `.jpg` to `.html`\nto reproduce open messages and start a conversation \nupload this image F143743 and send it in the conversation \nopen the image source url it will look alike \n\nhttps://ton.twitter.com/i/ton/data/dm/123456789/987654321/AbCdEf.jpg:large\n\nremove the last part `:large`\nand put `%23.html`\nXSS popup box will popup\n\nhowever this image can only appear to you and to the one who you send it to because it is a private message\nand to send the message you have to follow the victim and the victim has to follow you in most cases\nand ton.twitter.com has no valuable cookies at all \nso the impact will be a phishing page or let the victim downloading a malicious software after sending the injected image on a message \n\n###CRLF + XSS:\nboth bugs separately are too weak \nbut by joining them together the impact will be much more powerful\nton.twitter.com showing the image to the one who has a valid `auth_token` cookie with a value that has the right to see the injected image \nas example the attackers' `auth_token` is valid and has the right to see the injected image\nso if the attacker injected his own `auth_token` to the victim by CRLF\nthe injected image will appear to the victim even if the victim not following you\ncausing a XSS to occur \nthe following URL will:\n[1] change auth_token value to my own `auth_token` value to make the injected image appear in your pc\n[2] will redirect you to the injected imaged\n[3] Javascript will be executed causing attacker's phishing page to appear\nhttps://ton.twitter.com/1.1/ton/data/dm/809353163740483587/809353151434330112/O5hEYiOt.jpg%2523.html%E5%98%8A%E5%98%8Dset-cookie%3A%20auth_token%3Db2868e3d5fd901a1cf4819afd147ee893f331294%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC%3BSecure%3BHTTPOnly\n\n###Impacts\n[1] phishing\n[2] crlf injection (cookie injection & DOS may occur & cache poisoning )\n[3] under certain circumstances it may lead to bypassing CSP in https://twitter.com \n\n###POCS\nF143759\nF143760\nF143761\n\nThank you!", "published": "2016-12-15T11:41:34", "modified": "2017-07-05T23:54:50", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/191380", "reporter": "seifelsallamy", "references": [], "cvelist": [], "type": "hackerone", "lastseen": "2018-04-19T17:34:09", "history": [{"bulletin": {"bounty": 1680.0, "bountyState": "resolved", "bulletinFamily": "bugbounty", "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Hey,\n\n###[1] CRLF:\nIt's similar to #52042 but weaker\nto reproduce go to:\nhttps://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC\n\nyou will find that `test` cookie with the value `test` has been added to your cookies\n\n###[2] XSS:\nXSS can occur by injecting a `.jpg` image \nand uploading it to twitter\nthen changing the extension from `.jpg` to `.html`\nto reproduce open messages and start a conversation \nupload this image F143743 and send it in the conversation \nopen the image source url it will look alike \n\nhttps://ton.twitter.com/i/ton/data/dm/123456789/987654321/AbCdEf.jpg:large\n\nremove the last part `:large`\nand put `%23.html`\nXSS popup box will popup\n\nhowever this image can only appear to you and to the one who you send it to because it is a private message\nand to send the message you have to follow the victim and the victim has to follow you in most cases\nand ton.twitter.com has no valuable cookies at all \nso the impact will be a phishing page or let the victim downloading a malicious software after sending the injected image on a message \n\n###CRLF + XSS:\nboth bugs separately are too weak \nbut by joining them together the impact will be much more powerful\nton.twitter.com showing the image to the one who has a valid `auth_token` cookie with a value that has the right to see the injected image \nas example the attackers' `auth_token` is valid and has the right to see the injected image\nso if the attacker injected his own `auth_token` to the victim by CRLF\nthe injected image will appear to the victim even if the victim not following you\ncausing a XSS to occur \nthe following URL will:\n[1] change auth_token value to my own `auth_token` value to make the injected image appear in your pc\n[2] will redirect you to the injected imaged\n[3] Javascript will be executed causing attacker's phishing page to appear\nhttps://ton.twitter.com/1.1/ton/data/dm/809353163740483587/809353151434330112/O5hEYiOt.jpg%2523.html%E5%98%8A%E5%98%8Dset-cookie%3A%20auth_token%3Db2868e3d5fd901a1cf4819afd147ee893f331294%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC%3BSecure%3BHTTPOnly\n\n###Impacts\n[1] phishing\n[2] crlf injection (cookie injection & DOS may occur & cache poisoning )\n[3] under certain circumstances it may lead to bypassing CSP in https://twitter.com \n\n###POCS\nF143759\nF143760\nF143761\n\nThank you!", "edition": 3, "enchantments": {"score": {"modified": "2017-08-29T13:11:22", "value": 6.0}}, "h1reporter": {"disabled": false, "hacker_mediation": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/003/804/400900931f5f9bbb690550d96771f0156a0a9dea_small.jpg?1492164268"}, "url": "/seifelsallamy", "username": "seifelsallamy"}, "h1team": {"handle": "twitter", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/000/061/e78ef26a3191adcabe7311daa107bd9e152d3b5c_medium.?1439954730", "small": "https://profile-photos.hackerone-user-content.com/production/000/000/061/4acfe72859c5e9cb48a152edb4e498e13fa28df2_small.?1439954730"}, "url": "https://hackerone.com/twitter"}, "hash": "0278e431a07746ccf0bec0de92f83eeb5ad6a68fab39aad3f49473e7e7be6ff1", "hashmap": [{"hash": "06952aeab6e8f6bebbcc360c33b9b71e", "key": "h1reporter"}, {"hash": "1ced68149d11e909180450804d026dca", "key": "href"}, {"hash": "ec83c92514064cbcd1d6878e7bc2471a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "29fa83b4b41aaa48d91ea13ba0b18875", "key": "bounty"}, {"hash": "7da2fd0335ab1fc25312ef2b08308a72", "key": "reporter"}, {"hash": "05ada9a7482161942c43eadd60b0440c", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "248b2030654e28223b51e33da4ea8dad", "key": "modified"}, {"hash": "6dcc998185ab5b9b78620474b7dc90da", "key": "description"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "c4318eaf51138bc695cf245d5605f7b4", "key": "title"}, {"hash": "7652492d34b17c23dc2e7da6f1780460", "key": "h1team"}, {"hash": "4933443e459527d934c6f5262eab2d54", "key": "published"}, {"hash": "fafdd4fbb3fee9a56e17d43689f48d18", "key": "bountyState"}], "history": [], "href": "https://hackerone.com/reports/191380", "id": "H1:191380", "lastseen": "2017-08-29T13:11:22", "modified": "2017-07-05T23:54:50", "objectVersion": "1.3", "published": "2016-12-15T11:41:34", "references": [], "reporter": "seifelsallamy", "title": "Twitter: CRLF and XSS stored on ton.twitter.com", "type": "hackerone", "viewCount": 1}, "differentElements": ["h1reporter"], "edition": 3, "lastseen": "2017-08-29T13:11:22"}, {"bulletin": {"bounty": 1680.0, "bountyState": "resolved", "bulletinFamily": "bugbounty", "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Hey,\n\n###[1] CRLF:\nIt's similar to #52042 but weaker\nto reproduce go to:\nhttps://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC\n\nyou will find that `test` cookie with the value `test` has been added to your cookies\n\n###[2] XSS:\nXSS can occur by injecting a `.jpg` image \nand uploading it to twitter\nthen changing the extension from `.jpg` to `.html`\nto reproduce open messages and start a conversation \nupload this image F143743 and send it in the conversation \nopen the image source url it will look alike \n\nhttps://ton.twitter.com/i/ton/data/dm/123456789/987654321/AbCdEf.jpg:large\n\nremove the last part `:large`\nand put `%23.html`\nXSS popup box will popup\n\nhowever this image can only appear to you and to the one who you send it to because it is a private message\nand to send the message you have to follow the victim and the victim has to follow you in most cases\nand ton.twitter.com has no valuable cookies at all \nso the impact will be a phishing page or let the victim downloading a malicious software after sending the injected image on a message \n\n###CRLF + XSS:\nboth bugs separately are too weak \nbut by joining them together the impact will be much more powerful\nton.twitter.com showing the image to the one who has a valid `auth_token` cookie with a value that has the right to see the injected image \nas example the attackers' `auth_token` is valid and has the right to see the injected image\nso if the attacker injected his own `auth_token` to the victim by CRLF\nthe injected image will appear to the victim even if the victim not following you\ncausing a XSS to occur \nthe following URL will:\n[1] change auth_token value to my own `auth_token` value to make the injected image appear in your pc\n[2] will redirect you to the injected imaged\n[3] Javascript will be executed causing attacker's phishing page to appear\nhttps://ton.twitter.com/1.1/ton/data/dm/809353163740483587/809353151434330112/O5hEYiOt.jpg%2523.html%E5%98%8A%E5%98%8Dset-cookie%3A%20auth_token%3Db2868e3d5fd901a1cf4819afd147ee893f331294%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC%3BSecure%3BHTTPOnly\n\n###Impacts\n[1] phishing\n[2] crlf injection (cookie injection & DOS may occur & cache poisoning )\n[3] under certain circumstances it may lead to bypassing CSP in https://twitter.com \n\n###POCS\nF143759\nF143760\nF143761\n\nThank you!", "edition": 4, "enchantments": {"score": {"modified": "2018-02-07T16:57:58", "value": 2.8, "vector": "AV:N/AC:M/Au:M/C:N/I:P/A:N/"}}, "h1reporter": {"disabled": false, "hacker_mediation": false, "hackerone_triager": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/003/804/400900931f5f9bbb690550d96771f0156a0a9dea_small.jpg?1492164268"}, "url": "/seifelsallamy", "username": "seifelsallamy"}, "h1team": {"handle": "twitter", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/000/061/e78ef26a3191adcabe7311daa107bd9e152d3b5c_medium.?1439954730", "small": "https://profile-photos.hackerone-user-content.com/production/000/000/061/4acfe72859c5e9cb48a152edb4e498e13fa28df2_small.?1439954730"}, "url": "https://hackerone.com/twitter"}, "hash": "c3175a54d935c398eb667f477724e217441f17eb292a71356c234c886c8a9017", "hashmap": [{"hash": "97ab65ccc79a06edaed53541bac4e4cb", "key": "h1reporter"}, {"hash": "1ced68149d11e909180450804d026dca", "key": "href"}, {"hash": "ec83c92514064cbcd1d6878e7bc2471a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "29fa83b4b41aaa48d91ea13ba0b18875", "key": "bounty"}, {"hash": "7da2fd0335ab1fc25312ef2b08308a72", "key": "reporter"}, {"hash": "05ada9a7482161942c43eadd60b0440c", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "248b2030654e28223b51e33da4ea8dad", "key": "modified"}, {"hash": "6dcc998185ab5b9b78620474b7dc90da", "key": "description"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "c4318eaf51138bc695cf245d5605f7b4", "key": "title"}, {"hash": "7652492d34b17c23dc2e7da6f1780460", "key": "h1team"}, {"hash": "4933443e459527d934c6f5262eab2d54", "key": "published"}, {"hash": "fafdd4fbb3fee9a56e17d43689f48d18", "key": "bountyState"}], "history": [], "href": "https://hackerone.com/reports/191380", "id": "H1:191380", "lastseen": "2018-02-07T16:57:58", "modified": "2017-07-05T23:54:50", "objectVersion": "1.3", "published": "2016-12-15T11:41:34", "references": [], "reporter": "seifelsallamy", "title": "Twitter: CRLF and XSS stored on ton.twitter.com", "type": "hackerone", "viewCount": 2}, "differentElements": ["h1team", "h1reporter"], "edition": 4, "lastseen": "2018-02-07T16:57:58"}, {"bulletin": {"bounty": 1680.0, "bountyState": "resolved", "bulletinFamily": "bugbounty", "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Hey,\n\n###[1] CRLF:\nIt's similar to #52042 but weaker\nto reproduce go to:\nhttps://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC\n\nyou will find that `test` cookie with the value `test` has been added to your cookies\n\n###[2] XSS:\nXSS can occur by injecting a `.jpg` image \nand uploading it to twitter\nthen changing the extension from `.jpg` to `.html`\nto reproduce open messages and start a conversation \nupload this image F143743 and send it in the conversation \nopen the image source url it will look alike \n\nhttps://ton.twitter.com/i/ton/data/dm/123456789/987654321/AbCdEf.jpg:large\n\nremove the last part `:large`\nand put `%23.html`\nXSS popup box will popup\n\nhowever this image can only appear to you and to the one who you send it to because it is a private message\nand to send the message you have to follow the victim and the victim has to follow you in most cases\nand ton.twitter.com has no valuable cookies at all \nso the impact will be a phishing page or let the victim downloading a malicious software after sending the injected image on a message \n\n###CRLF + XSS:\nboth bugs separately are too weak \nbut by joining them together the impact will be much more powerful\nton.twitter.com showing the image to the one who has a valid `auth_token` cookie with a value that has the right to see the injected image \nas example the attackers' `auth_token` is valid and has the right to see the injected image\nso if the attacker injected his own `auth_token` to the victim by CRLF\nthe injected image will appear to the victim even if the victim not following you\ncausing a XSS to occur \nthe following URL will:\n[1] change auth_token value to my own `auth_token` value to make the injected image appear in your pc\n[2] will redirect you to the injected imaged\n[3] Javascript will be executed causing attacker's phishing page to appear\nhttps://ton.twitter.com/1.1/ton/data/dm/809353163740483587/809353151434330112/O5hEYiOt.jpg%2523.html%E5%98%8A%E5%98%8Dset-cookie%3A%20auth_token%3Db2868e3d5fd901a1cf4819afd147ee893f331294%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC%3BSecure%3BHTTPOnly\n\n###Impacts\n[1] phishing\n[2] crlf injection (cookie injection & DOS may occur & cache poisoning )\n[3] under certain circumstances it may lead to bypassing CSP in https://twitter.com \n\n###POCS\nF143759\nF143760\nF143761\n\nThank you!", "edition": 1, "enchantments": {}, "h1reporter": {"disabled": false, "hacker_mediation": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/003/804/400900931f5f9bbb690550d96771f0156a0a9dea_small.jpg?1492164268"}, "url": "/seifelsallamy", "username": "seifelsallamy"}, "h1team": {"handle": "twitter", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/000/061/e78ef26a3191adcabe7311daa107bd9e152d3b5c_medium.?1439954730", "small": "https://profile-photos.hackerone-user-content.com/production/000/000/061/4acfe72859c5e9cb48a152edb4e498e13fa28df2_small.?1439954730"}, "url": "https://hackerone.com/twitter"}, "hash": "d233a04e9cad686ce36a0b012cdac9c4296257974cbd6b2330529f0e50ffc1cb", "hashmap": [{"hash": "1ced68149d11e909180450804d026dca", "key": "href"}, {"hash": "ec83c92514064cbcd1d6878e7bc2471a", "key": "type"}, {"hash": "02ed8b049599be232fa8aa058bf49aaf", "key": "h1reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "29fa83b4b41aaa48d91ea13ba0b18875", "key": "bounty"}, {"hash": "7da2fd0335ab1fc25312ef2b08308a72", "key": "reporter"}, {"hash": "05ada9a7482161942c43eadd60b0440c", "key": "bulletinFamily"}, {"hash": "fe3f171f649be7d45d9d11d3f5d45695", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "6dcc998185ab5b9b78620474b7dc90da", "key": "description"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "c4318eaf51138bc695cf245d5605f7b4", "key": "title"}, {"hash": "7652492d34b17c23dc2e7da6f1780460", "key": "h1team"}, {"hash": "4933443e459527d934c6f5262eab2d54", "key": "published"}, {"hash": "fafdd4fbb3fee9a56e17d43689f48d18", "key": "bountyState"}], "history": [], "href": "https://hackerone.com/reports/191380", "id": "H1:191380", "lastseen": "2017-08-22T11:09:39", "modified": "1970-01-01T00:00:00", "objectVersion": "1.3", "published": "2016-12-15T11:41:34", "references": [], "reporter": "seifelsallamy", "title": "Twitter: CRLF and XSS stored on ton.twitter.com", "type": "hackerone", "viewCount": 0}, "differentElements": ["h1reporter"], "edition": 1, "lastseen": "2017-08-22T11:09:39"}, {"bulletin": {"bounty": 1680.0, "bountyState": "resolved", "bulletinFamily": "bugbounty", "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Hey,\n\n###[1] CRLF:\nIt's similar to #52042 but weaker\nto reproduce go to:\nhttps://ton.twitter.com/1.1/ton/data/dm/x/%E5%98%8A%E5%98%8Dset-cookie%3A%20test%3Dtest%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC\n\nyou will find that `test` cookie with the value `test` has been added to your cookies\n\n###[2] XSS:\nXSS can occur by injecting a `.jpg` image \nand uploading it to twitter\nthen changing the extension from `.jpg` to `.html`\nto reproduce open messages and start a conversation \nupload this image F143743 and send it in the conversation \nopen the image source url it will look alike \n\nhttps://ton.twitter.com/i/ton/data/dm/123456789/987654321/AbCdEf.jpg:large\n\nremove the last part `:large`\nand put `%23.html`\nXSS popup box will popup\n\nhowever this image can only appear to you and to the one who you send it to because it is a private message\nand to send the message you have to follow the victim and the victim has to follow you in most cases\nand ton.twitter.com has no valuable cookies at all \nso the impact will be a phishing page or let the victim downloading a malicious software after sending the injected image on a message \n\n###CRLF + XSS:\nboth bugs separately are too weak \nbut by joining them together the impact will be much more powerful\nton.twitter.com showing the image to the one who has a valid `auth_token` cookie with a value that has the right to see the injected image \nas example the attackers' `auth_token` is valid and has the right to see the injected image\nso if the attacker injected his own `auth_token` to the victim by CRLF\nthe injected image will appear to the victim even if the victim not following you\ncausing a XSS to occur \nthe following URL will:\n[1] change auth_token value to my own `auth_token` value to make the injected image appear in your pc\n[2] will redirect you to the injected imaged\n[3] Javascript will be executed causing attacker's phishing page to appear\nhttps://ton.twitter.com/1.1/ton/data/dm/809353163740483587/809353151434330112/O5hEYiOt.jpg%2523.html%E5%98%8A%E5%98%8Dset-cookie%3A%20auth_token%3Db2868e3d5fd901a1cf4819afd147ee893f331294%3B%20Domain%3D.twitter.com%3B%20Path%3D%2F%3B%20Expires%3DSat%2C%2015-Dec-2018%2009%3A45%3A55%20UTC%3BSecure%3BHTTPOnly\n\n###Impacts\n[1] phishing\n[2] crlf injection (cookie injection & DOS may occur & cache poisoning )\n[3] under certain circumstances it may lead to bypassing CSP in https://twitter.com \n\n###POCS\nF143759\nF143760\nF143761\n\nThank you!", "edition": 2, "enchantments": {}, "h1reporter": {"disabled": false, "hacker_mediation": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/production/000/003/804/400900931f5f9bbb690550d96771f0156a0a9dea_small.jpg?1492164268"}, "url": "/seifelsallamy", "username": "seifelsallamy"}, "h1team": {"handle": "twitter", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/production/000/000/061/e78ef26a3191adcabe7311daa107bd9e152d3b5c_medium.?1439954730", "small": "https://profile-photos.hackerone-user-content.com/production/000/000/061/4acfe72859c5e9cb48a152edb4e498e13fa28df2_small.?1439954730"}, "url": "https://hackerone.com/twitter"}, "hash": "f30b82a94cd2c3f0c27fc3d3bcaa404e0ecf825ec7310308f5a78fbe9513f20d", "hashmap": [{"hash": "06952aeab6e8f6bebbcc360c33b9b71e", "key": "h1reporter"}, {"hash": "1ced68149d11e909180450804d026dca", "key": "href"}, {"hash": "ec83c92514064cbcd1d6878e7bc2471a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "29fa83b4b41aaa48d91ea13ba0b18875", "key": "bounty"}, {"hash": "7da2fd0335ab1fc25312ef2b08308a72", "key": "reporter"}, {"hash": "05ada9a7482161942c43eadd60b0440c", "key": "bulletinFamily"}, {"hash": "fe3f171f649be7d45d9d11d3f5d45695", "key": "modified"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "6dcc998185ab5b9b78620474b7dc90da", "key": "description"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "c4318eaf51138bc695cf245d5605f7b4", "key": "title"}, {"hash": "7652492d34b17c23dc2e7da6f1780460", "key": "h1team"}, {"hash": "4933443e459527d934c6f5262eab2d54", "key": "published"}, {"hash": "fafdd4fbb3fee9a56e17d43689f48d18", "key": "bountyState"}], "history": [], "href": "https://hackerone.com/reports/191380", "id": "H1:191380", "lastseen": "2017-08-28T23:19:22", "modified": "1970-01-01T00:00:00", "objectVersion": "1.3", "published": "2016-12-15T11:41:34", "references": [], "reporter": "seifelsallamy", "title": "Twitter: CRLF and XSS stored on ton.twitter.com", "type": "hackerone", "viewCount": 0}, "differentElements": ["modified"], "edition": 2, "lastseen": "2017-08-28T23:19:22"}], "edition": 5, "hashmap": [{"key": "bounty", "hash": "29fa83b4b41aaa48d91ea13ba0b18875"}, {"key": "bountyState", "hash": "fafdd4fbb3fee9a56e17d43689f48d18"}, {"key": "bulletinFamily", "hash": "05ada9a7482161942c43eadd60b0440c"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "6dcc998185ab5b9b78620474b7dc90da"}, {"key": "h1reporter", "hash": "1c00d44263051084c4684c8ea0e2c252"}, {"key": "h1team", "hash": "69befcf675098e037f254469b9b66fc8"}, {"key": "href", "hash": "1ced68149d11e909180450804d026dca"}, {"key": "modified", "hash": "248b2030654e28223b51e33da4ea8dad"}, {"key": "published", "hash": "4933443e459527d934c6f5262eab2d54"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "7da2fd0335ab1fc25312ef2b08308a72"}, {"key": "title", "hash": "c4318eaf51138bc695cf245d5605f7b4"}, {"key": "type", "hash": "ec83c92514064cbcd1d6878e7bc2471a"}], "hash": "331afe5bbdd44d616792ff4fd66be5d7c2ab14fc1f780741369e9c23b7b36214", "viewCount": 2, "enchantments": {"vulnersScore": 2.8}, "objectVersion": "1.3", "bounty": 1680.0, "bountyState": "resolved", "h1team": {"handle": "twitter", "profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/000/000/061/e78ef26a3191adcabe7311daa107bd9e152d3b5c_medium.?1439954730", "small": "https://profile-photos.hackerone-user-content.com/000/000/061/4acfe72859c5e9cb48a152edb4e498e13fa28df2_small.?1439954730"}, "url": "https://hackerone.com/twitter"}, "h1reporter": {"disabled": false, "hacker_mediation": false, "hackerone_triager": false, "is_me?": false, "profile_picture_urls": {"small": "https://profile-photos.hackerone-user-content.com/000/003/804/400900931f5f9bbb690550d96771f0156a0a9dea_small.jpg?1492164268"}, "url": "/seifelsallamy", "username": "seifelsallamy"}}