# Highly wormable clickjacking in player card

Twitter Player Card iframes allowed framing twitter.com in Safari/IE lacking CSP2 frame-ancestors, enabling clickjacking to force victims to tweet, follow, or retweet.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: filedescriptor
- Disclosed: 2018-05-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/85624
- Library page: https://bugbountylibrary.com/r/h1%3A85624
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:cdn technique:chained vuln:clickjacking

**Target:** Twitter Player Card embedded iframe on twitter.com
**Root cause:** Clickjacking defenses relied on X-Frame-Options SAMEORIGIN (bypassable via nested attacker frame) and CSP2 frame-ancestors (unsupported in Safari/IE); Player Card iframes let attacker HTML embed twitter.com, and sandbox could disable the JS frame-buster.
**Steps:**
1. Clone twitterdev/cards player card bundle
2. Set `twitter:player` to attacker-controlled HTML file
3. In that HTML embed `<iframe src="//twitter.com"></iframe>`
4. Post the whitelisted-domain link in a Tweet
5. Open the tweet in Safari or IE; the embedded Twitter page renders and can be overlaid with bait content
**How found:** Reasoned through the three clickjacking defenses: noted SAMEORIGIN only compares top-window origin (bypassable via twitter.com -> attacker.com -> twitter.com nesting), CSP2 frame-ancestors unsupported in Safari/IE, and JS frame-busters defeatable via iframe sandbox; then applied this to the Player Card iframe surface.
**Exploitation:** Attacker overlays bait (fake video play button) over the framed twitter.com page inside the Player Card shown in the victim's timeline; a single subtle click triggers click-based actions like tweet, follow, retweet, or favorite, and the forced tweet spreads the card to further victims (wormable).
**Escalation:** Wormable propagation: each victim's forced tweet re-exposes the malicious card to their followers; promoted tweets could scale reach and auto-expand the player.
**Insight:** When a product embeds user-controlled HTML in an iframe on the main origin, check per-browser support of frame-ancestors and whether nested-frame SAMEORIGIN bypass plus sandbox-disabled frame-busters reopen clickjacking on legacy browsers.