# [dev.twitter.com] XSS and Open Redirect

dev.twitter.com reflected a crafted Request-URI into a redirect Location and page link, yielding open redirect in all browsers and javascript: XSS in Firefox.

- Payout: $1,120
- Severity: medium
- Program: X / xAI
- Credited: bobrov
- Disclosed: 2017-09-29
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/260744
- Library page: https://bugbountylibrary.com/r/h1%3A260744
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:firefox technique:parser-differential vuln:open-redirect vuln:xss

**Target:** dev.twitter.com redirect endpoint
**Root cause:** The Location header and the on-page redirect link processed the Request-URI differently; an invalid port in the Location blocked Firefox's redirect while the page link rendered a javascript: URL.
**Steps:**
1. Open `https://dev.twitter.com/https:/%5cblackfan.ru/` -> 302 `location: https:/\blackfan.ru` (open redirect)
2. Open `https://dev.twitter.com//x:1/:///%01javascript:alert(document.cookie)/` in Firefox
3. Response 302 `location: //x:1/://dev.twitter.com/javascript:alert(document.cookie)`
4. Page renders `<a href="javascript:alert(document.cookie)">`; click it to execute
**How found:** Noticed the Location header and the page's redirect link parsed the Request-URI differently; hypothesized an invalid port would suppress Firefox's redirect while the link still emitted attacker-controlled scheme, then crafted `%01javascript:` payload.
**Exploitation:** Victim clicks crafted dev.twitter.com link; Firefox fails to follow the malformed-port Location and instead shows the auto-redirect page whose anchor href is a javascript: URI, executing script in the dev.twitter.com origin on click.
**Insight:** When a redirect endpoint both sets Location and renders a fallback link, test inputs that make the two parsers disagree (invalid port, backslashes, control chars like %01) so the browser follows the link instead of the header.