PT-2018-5138 · Twitter · Twitter Kit For Ios

Published 2018-02-09 · Updated 2019-10-09 · CVE-2017-0911

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Twitter Kit for iOS versions 3.0 through 3.2.1

Description The issue concerns a callback verification flaw in the "Login with Twitter" component, allowing an attacker to provide alternate credentials. During the "Login with Twitter" authentication process, authentication information is passed back to the application using a registered custom URL scheme, typically in the format 'twitterkit-', on iOS devices. The callback handler fails to verify the authenticity of the response, making this step vulnerable to forgery. This could potentially allow an attacker to associate a Twitter account with a third-party service.

Recommendations For Twitter Kit for iOS versions 3.0 through 3.2.1, consider disabling the "Login with Twitter" component until a patch is available to prevent potential forgery attacks. Restrict access to the custom URL scheme, typically 'twitterkit-', to minimize the risk of exploitation. Avoid using the "Login with Twitter" feature in affected versions until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-360

CWE-287

Related Identifiers

CVE-2017-0911

Affected Products

Twitter Kit For Ios

References · 7

• https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71 · Patch
• https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-0911 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0911 · Vendor Advisory
• https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017 · Note
• https://hackerone.com/reports/290229 · Note
• https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html · Note