PT-2019-17663 · Twitter · Twitter Kit For Ios

Publicado 2019-05-06 · Atualizado 2020-10-16 · CVE-2019-5431

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Twitter Kit for iOS versions 3.0 through 3.4.0

Description The issue is caused by an incomplete fix and is related to a callback verification flaw in the "Login with Twitter" component. This flaw allows an attacker to provide alternate credentials. During the "Login with Twitter" authentication process, authentication information is passed back to the application using a registered custom URL scheme, typically in the format twitterkit-<consumer-key>, on iOS. The callback handler does not verify the authenticity of the response, making this step vulnerable to forgery. This could potentially allow an attacker to associate a Twitter account with a third-party service.

Recommendations For Twitter Kit for iOS versions 3.0 through 3.4.0, consider disabling the "Login with Twitter" component until a patch is available to prevent exploitation of the callback verification flaw. Restrict access to the custom URL scheme, typically in the format twitterkit-<consumer-key>, to minimize the risk of forgery.

Correção

CSRF

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-352

CWE-345

Identificadores relacionados

CVE-2019-5431

Produtos afetados

Twitter Kit For Ios

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-5431 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5431 · Nota de Segurança
• https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html · Aviso do Fabricante