# Redirect URL in /intent/ functionality is not properly escaped

Twitter /intent/favorite reflected the original_referer parameter unescaped into a hidden field and link, enabling attribute-injection XSS when Referer was twitter.com.

- Payout: hidden
- Severity: medium
- Program: X / xAI
- Found by: homakov
- Disclosed: 2015-02-24
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/48516
- Library page: https://bugbountylibrary.com/r/h1%3A48516
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:xss

**Target:** Web endpoint /intent/favorite (original_referer parameter)
**Root cause:** The original_referer parameter was reflected unescaped into a hidden input value and a 'Return to previous site' link when the Referer header was twitter.com, allowing attribute injection.
**Steps:**
1. Craft URL `https://twitter.com/intent/favorite?original_referer=<payload>&tweet_id=440322224407314432` where payload is `%20style%3D...%20onmouseover%3Dalert(0)...`
2. Because t.co strips Referer, first visit an intent page so the resulting page's Referer is twitter.com, then click through to the crafted URL
3. Victim clicks the 'Return to previous site' link, which reloads the page with original_referer=injection reflected as-is
4. Injected event handlers (e.g. onmouseover=alert(0)) execute on the link
**How found:** While building a side-channel tool to detect whether a user follows/favorites a tweet (Twitter calls window.close() in that case), the researcher probed the /intent/ flow and noticed original_referer was reflected unescaped when Referer was twitter.com.
**Exploitation:** Attacker sends victim a link to a tweet they follow but haven't favorited; the intent dialog's hidden referer field carries the payload, and clicking 'Return to previous site' reflects it, executing injected handlers on mouseover.
**Insight:** Intent/redirect endpoints that trust the Referer header to decide whether to reflect a user-supplied 'original_referer' are worth probing; use the endpoint itself twice to manufacture a trusted Referer when t.co strips it.