Twitter: Following a User Actually Follows Another User

2015-10-22T23:07:36
ID H1:95243
Type hackerone
Reporter ericr
Modified 2015-12-02T17:40:51

Description

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:

https://twitter.com/intent/follow?screen_name=twitter&screen_name=ericrtest3&user_id=113483807

This is somewhat related to the last bug I submitted (see #95217), albeit the impact is more dramatic. This can be used by malicious users such as spammers and social engineers to trick a user into following them.