# DOMXSS in Tweetdeck

TweetDeck rendered attacker-controlled Twitter app name into a jQuery $() sink, executing DOM XSS when a victim clicked the tweet's client label.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2017-04-02
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/119471
- Library page: https://bugbountylibrary.com/r/h1%3A119471
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high technique:js-analysis technique:source-review vuln:xss

**Target:** TweetDeck web client (bundle.js) tweet source label
**Root cause:** The tweet's source (client app name) is attacker-controllable via the application name and passed unsanitized into jQuery's $() sink in the followSourceLink handler, which parses HTML.
**Steps:**
1. Create a Twitter application whose name is the payload `<svg onload=alert(document.domain)>`.
2. Post a tweet using that application so the tweet's source label contains the payload.
3. As victim in latest IE (to bypass CSP), follow/search the attacker on TweetDeck and expand the tweet.
4. Click the app info label (e.g. bait name 'Click here to get followers') triggering `TD.util.openURL($(n.getMainTweet().source).attr("href"))` and XSS.
**How found:** Code review of TweetDeck's bundle.js found the followSourceLink case passing `n.getMainTweet().source` into jQuery $(); noting the app name is user-controllable and allows angle brackets, they identified the DOMXSS sink.
**Exploitation:** Attacker registers a malicious app name, tweets with it, and lures a victim to click the tweet's client label in TweetDeck; jQuery $() parses the injected HTML and fires the onload handler in the victim's session.
**Insight:** Tweet 'source' labels are attacker-controlled via app registration and often rendered through HTML-parsing sinks like jQuery $(); check client-name rendering paths, and note CSP may only be bypassable in older browsers like IE.