Summary
A Reflected Cross Site Scripting (XSS) was found in twitter-server. The vulnerability exists in the administration panel of twitter-server in the histograms component.
Product
Twitter-server before 20.12.0
Impact
This can cause arbitrary JavaScript code to run on the victim’s browser and allowed attackers to retrieve information presented in the twitter-server admin dashboard web-application.
Steps to reproduce
1. Create basic twitter-server instance.
2. Add “finagle-stats” dependency to project to enable histograms tab.
>>> Can be added explicitly – e.g. in build.sbt – libraryDependencies += “com.twitter” %% “finagle-stats” % “20.10.0”.
>>> Implicitly as part of the finatra-http dependency – e.g. in build.sbt – libraryDependencies += “com.twitter” %% “finatra-http” % “20.10.0
3. Run project.
4. Browse to: http://twitter-server-host/admin/histograms?h=%3Cscript%3Ealert(1)%3C/script%3E&fmt=plot_cdf&log_scale=trueExpected result:
An alert box should be displayed with the text “1”.
Remediation
Update twitter-server dependency to 20.12.0 and above
Credit
This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.
