# [Twitter Open Source] Releases were & are built/executed/tested/released in the context of insecure/untrusted code

Twitter open-source Scala/Java projects resolved build dependencies over HTTP, letting a network MITM swap JARs and achieve RCE during builds and tests.

- Payout: $280
- Severity: high
- Program: X / xAI
- Found by: jlleitschuh
- Disclosed: 2019-12-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/505007
- Library page: https://bugbountylibrary.com/r/h1%3A505007
- Tags: area:oss domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:java technique:recon technique:source-review vuln:misconfiguration vuln:rce

**Target:** SBT/Maven build files (plugins.sbt, pom.xml) resolving dependencies over HTTP
**Root cause:** Build files declare resolvers/repositories using http:// instead of https:// with no integrity check, so dependency JARs are fetched over an untrusted channel and executed during build/test.
**Steps:**
1. Clone an impacted project (e.g. twitter/scrooge, tormenta, scalding).
2. Edit Dilettante's target line (`dilettante.py#L143`) to point at the repository used in the build.
3. Start Dilettante locally.
4. Proxy the build's HTTP traffic through Dilettante.
5. Execute the build's tests.
6. Dilettante serves a malicious JAR; the build executes it (cat image as proof).
**How found:** Searched the Twitter GitHub org for build files containing `resolvers http://` and `repositories http://` via GitHub code search, then enumerated SBT plugins.sbt and Maven pom.xml hits.
**Exploitation:** Attacker on the network path (MITM, malicious Wi-Fi, ISP injection) intercepts the plaintext HTTP dependency fetch and substitutes a malicious JAR; the build/test process executes it, yielding code execution on the build or production server and poisoning released artifacts and shared caches (~/.m2, ~/.gradle).
**Escalation:** Compromised JARs persist in shared artifact caches and released build artifacts, so downstream developers and production servers remain infected even after updating.
**Insight:** GitHub code search for `org:<target> resolvers http://` / `repositories http://` quickly surfaces supply-chain MITM exposure in JVM build files; also check shared artifact caches for persistence of poisoned JARs.

## Proof of concept (copied exactly from the original report)

**Steps to reproduce using Dilettante MITM proxy**

```
1. Cone the Impacted Project
  2. Change this line in Dilettante so it is targeting the repository used in the build.
       https://github.com/mveytsman/dilettante/blob/master/dilettante.py#L143
  3. Start Dilettante on your local machine.
  4. Proxy the HTTP traffic for the build through Dilettante
  5. Execute the Build's tests.
  6. You should be greeted with the image of a cat.
```

**Scrooge SBT plugins.sbt HTTP resolver**

```
https://github.com/twitter/scrooge/blob/b8fb8b563cb152b5d46c2ec8a24c9c134cdde140/project/plugins.sbt#L1-L6
```

**Hdfs-Du pom.xml HTTP repository**

```
https://github.com/twitter/hdfs-du/blob/5caaa0cf117ed1ebbe873ec1e8302a535bd0bc5d/pom.xml#L64-L75
```