AfterDawn: Tech news

WARNING: TweetDeck vulnerable to XSS flaw (UPDATE: fixed!)

Written by James Delahunty (Google+) @ 11 Jun 2014 13:00

WARNING: TweetDeck vulnerable to XSS flaw (UPDATE: fixed!) Twitter's useful TweetDeck app is vulnerable to a cross-site-scripting (XSS) flaw that a lot of people have run in to today.
While browsing today, my TweetDeck tab in Google Chrome came to the front by itself with a message simply saying "XSS in TweetDeck". At the same time, my co-worker Jari sent me a link to a tweet that - when combined with TweetDeck - would automatically Re-tweet the message and spread.

Here is a screenshot of the tweet, before it is inevitably taken offline



It appears that to be affected by it, all you need is for it to appear in your timeline in TweetDeck at least in Google's Chrome browser. In our case, it was re-tweeted by an Adobe account, which then exploited the flaw in Jari's TweetDeck to retweet it, and then it showed up in my timeline and I retweeted it.

Of course, you can manually "un-retweet" it if you visit the actual tweet in a browser and just click the RT button again so it is no longer green. Here is the direct link, which should be safe to open in a browser.

You will know if you have been affected by this problem in Chrome if you see something like this...



This particular bit of code doesn't seem that serious on the surface, but as it spread it will cause a nightmare for tweetdeck users. In my case, my Chrome browser threads had to be manually killed to get away from TweetDeck. The code could also, at any point, be made more malicious. This one needs to be fixed ASAP.

UPDATE: TweetDeck has fixed the problem.


Tags: TweetDeck
Previous Next  
Comments have been disabled for this article.

Latest news

A bug in Chrome allows you to download Netflix movies A bug in Chrome allows you to download Netflix movies (25 Jun 2016 15:21)
A group of security researchers have found a vulnerability in Google's Chrome browser that allows downloading movies straight from Netflix. This is obviously not a feature especially the entertainment ....
7 user comments
Three out of four Netflix customers would rather cancel than watch ads Three out of four Netflix customers would rather cancel than watch ads (25 Jun 2016 14:05)
For a long time Netflix was adamant on its pricing. No changes were made for a long time and everything seemed to be good. The markets obviously reacted and more expensive deals and original ....
4 user comments
Apple Music left in the dust, Spotify at 100 million subscribers Apple Music left in the dust, Spotify at 100 million subscribers (25 Jun 2016 12:01)
Spotify has told The Telegraph that it has surpassed the 100 million mark in subscribers. Paying subscribers was earlier this year reported to have passed 30 million. Apple meanwhile is having ....
2 user comments
Rumor has it that Apple has cancelled iPhone's dual camera Rumor has it that Apple has cancelled iPhone's dual camera (18 Jun 2016 18:05)
The next iPhone will be a major upgrade to current iPhone 6s. This biyearly full upgrade cycle provides us with a bigger upgrade every two years. But how will Apple update its number one product, ....
6 user comments
OnePlus releases new flagship killer, smaller X discontinued OnePlus releases new "flagship killer", smaller X discontinued (18 Jun 2016 16:11)
The small Chinese smartphone maker OnePlus took the world by storm two years ago by releasing a super cheap flagship smartphone. They called it the flagship killer, and it indeed challenged ....
4 user comments

News archive