PT-2019-14605 · Twitter · Twitter Kit

Published 2019-10-07 · Updated 2019-10-09 · CVE-2019-16263

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Twitter Kit framework versions through 3.4.2 for iOS

Description The issue concerns the Twitter Kit framework's failure to properly validate the SSL certificate for api.twitter.com, specifically due to a lack of hostname verification. This could potentially lead to a man-in-the-middle (MITM) attack. The Twitter Kit framework is noted as an end-of-life product.

Recommendations For Twitter Kit framework versions through 3.4.2 for iOS, consider disabling the use of the Twitter API until a suitable replacement or fix can be implemented, as the product is end-of-life and no direct fix is available. Restrict access to sensitive data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-16263

Affected Products

Twitter Kit

References · 6

• 🔥 https://sit.fraunhofer.de/fileadmin/dokumente/CVE/Advisory_TwitterKit_for_iOS_CVE-2019-16263.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-16263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16263 · Security Note
• https://github.com/twitter-archive/twitter-kit-ios/blob/ac42e1351a66afa5ff7718d04d64a905dafe1f41/TwitterCore/TwitterCore/Networking/Security/TWTRServerTrustEvaluator.m#L75-L81 · Note
• https://blog.appicaptor.com/2019/10/04/vulnerable-library-warning-twitterkit-for-ios · Note
• https://t.me/thebugbountyhunter/3205 · Telegram Post