# Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requests

Twitter DM image URLs were cookie-authenticated but embeddable cross-origin, so an attacker could load a victim's private DM image on their site to confirm identity.

- Payout: $1,120
- Severity: medium
- Program: X / xAI
- Credited: cris-staicu
- Disclosed: 2019-02-08
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/329957
- Library page: https://bugbountylibrary.com/r/h1%3A329957
- Tags: domain:web impact:pii-leak kind:bounty platform:hackerone sev:medium tech:cdn technique:recon vuln:access-control vuln:info-disclosure

**Target:** ton.twitter.com DM image endpoint
**Root cause:** Private DM image URLs rely solely on cookie-based access control and are exempt from same-origin policy as images, so cross-origin embedding succeeds only for authorized users, leaking identity via load success/failure.
**Steps:**
1. Attacker sends victim a DM containing an image.
2. Copy the image address, e.g. `https://ton.twitter.com/1.1/ton/data/dm/971042231900622855/971042220110426113/dsxFPPP0.jpg:large` (accessible only to the two conversation participants).
3. Embed that URL as an `<img>` on an attacker-controlled page.
4. When the victim visits, the browser requests the image with their Twitter cookie; if it loads, the visitor is confirmed as the victim.
**How found:** Researchers reasoned that cookie-gated resources exempt from SOP (images) act as an oracle: reachability of a per-user private image leaks whether the current visitor is that user.
**Exploitation:** Attacker embeds the victim-specific DM image URL on a page they control; the victim's browser sends Twitter cookies cross-origin, and image load success reveals the visitor's identity.
**Insight:** Any per-user, cookie-authenticated resource that can be embedded cross-origin (images, media, fonts) becomes an identity oracle; test private/authenticated asset URLs as cross-site `<img>`/`<link>` probes to build a login-detection or user-identification primitive.