Samuel
@samuel.fm
a second twexit situation has hit the timeline
2 1 11
David Buchanansecond might be a bit generous. fourth maybe?
2 5Samuelhaha how did I miss the other ones
1 1David BuchananWell it just depends on how you count lol. The first one was XSS, but nobody was exploiting it, it was just a "hey you should fix it".
The second was the auth bypass that I rather cheekily exploited as a PoC to post from the official twexit account, but nothing beyond that.
3 4Samueldidn't see that second one lol
1David BuchananIt was what I was quoting here, although sadly it was since deleted bsky.app/profile/retr...
David Buchanan@retr0.id· 10 Oct 2023just to be clear - this post was made by me. that's the bug. I can post as anyone with an active twexit login session. (or uh, read their DMs, if I were so inclined)
David BuchananAnd the third was an SQL injection vuln which I reported privately around the same time as the second one (it was related to it), but I'm not sure I ever mentioned that one publicly.
2 4
haileyI wasn’t here for the first (or however many others lol) but I have to wonder…were the previous ones an exploit in like a normal post and now it was a reskeet that wasn’t getting escaped? I mean come on now
1 2David Buchananthat does appear to be what happened
3