# Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)

IDOR in ads.twitter.com media_id_to_cdn_url.json let any media_id resolve to a CDN URL, exposing private DM and protected-tweet media.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: indoappsec
- Disclosed: 2018-03-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/99600
- Library page: https://bugbountylibrary.com/r/h1%3A99600
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:idor

**Target:** ads.twitter.com JSON endpoint /media_id_to_cdn_url.json
**Root cause:** The media_id_to_cdn_url.json endpoint returned a CDN URL for any supplied media_id without verifying the requester owns or can view that media, so private DM and protected-tweet media resolved for anyone.
**Steps:**
1. Authenticate to ads.twitter.com and start a campaign tweet with an uploaded media to trigger the preview request.
2. Observe `GET /media_id_to_cdn_url.json?media_id=[Media_id]&_=1447455982153` returning the CDN link for the media.
3. Replace media_id with another user's media_id (e.g. from a DM or protected tweet).
4. Receive the CDN URL for that private media and fetch it.
**How found:** While creating an ad campaign tweet, noticed the media preview issued a JSON request keyed by media_id; hypothesized the id was not authorization-checked and tested other users' media_ids.
**Exploitation:** Attacker supplies arbitrary media_ids to the ads endpoint and receives CDN URLs for media belonging to other users, including DM attachments and protected-tweet media, then downloads them directly.
**Insight:** Ad/campaign composer preview endpoints often resolve media by raw id and skip the ownership check the main product enforces; test media_id-style lookups on ads.twitter.com against DM/protected-tweet media.