PT-2019-14605 · Twitter · Twitter Kit

Publicado 2019-10-07 · Atualizado 2019-10-09 · CVE-2019-16263

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Twitter Kit framework versions through 3.4.2 for iOS

Description The issue concerns the Twitter Kit framework's failure to properly validate the SSL certificate for api.twitter.com, specifically due to a lack of hostname verification. This could potentially lead to a man-in-the-middle (MITM) attack. The Twitter Kit framework is noted as an end-of-life product.

Recommendations For Twitter Kit framework versions through 3.4.2 for iOS, consider disabling the use of the Twitter API until a suitable replacement or fix can be implemented, as the product is end-of-life and no direct fix is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2019-16263

Produtos afetados

Twitter Kit

Referências · 6

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_TwitterKit_for_iOS_CVE-2019-16263.pdf · Exploit
• https://github.com/twitter-archive/twitter-kit-ios/blob/ac42e1351a66afa5ff7718d04d64a905dafe1f41/TwitterCore/TwitterCore/Networking/Security/TWTRServerTrustEvaluator.m#L75-L81 · Nota
• https://osv.dev/vulnerability/CVE-2019-16263 · Aviso do Fabricante
• https://blog.appicaptor.com/2019/10/04/vulnerable-library-warning-twitterkit-for-ios · Nota
• https://t.me/thebugbountyhunter/3205 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-16263 · Nota de Segurança