India’s Koo, a Twitter-like Service, Found Vulnerable to Critical Worm Attacks

Koo, India’s homegrown Twitter clone, recently patched a serious
security vulnerability that could have been exploited to execute
arbitrary JavaScript code against hundreds of thousands of its
users, spreading the attack across the platform.

The vulnerability involves a stored cross-site scripting flaw^[1] (also known as
persistent XSS) in Koo’s web application that allows malicious
scripts to be embedded directly into the affected web
application.

To carry out the attack, all a malicious actor had to do was log
into the service via the web application and post an XSS-encoded
payload to its timeline, which automatically gets executed on
behalf of all users who saw the post.

The issue was discovered by security researcher Rahul Kankrale^[2]
in July, following which a fix was rolled out by Koo on July 3.

Using cross-site scripting, an attacker can perform actions on
behalf of users with the same privileges as the user and steal web
browser’s secrets, such as authentication cookies.

Due to the fact that malicious JavaScript has access to all
objects that the website can access, it could allow adversaries to
sneak into sensitive data such as private messages, or spread
misinformation, or display spam using users’ profiles.

The end result of this vulnerability in Koo, also known as XSS
worm, is more worrisome because it automatically propagates
malicious code among a website’s visitors to infect other
users—without any user interaction, like a chain reaction.

Koo, which launched in November 2019, bills itself as an Indian
alternative to Twitter and boasts of 6 million active users on its
platform. The Bengaluru-based company has also emerged as the
social media service of choice in Nigeria after the country
indefinitely banned Twitter for deleting a tweet by Nigerian
President Muhammadu Buhari.

Aprameya Radhakrishna, co-founder, and chief executive officer
of Koo, announced the entry of the app into the Nigerian market
earlier this week.

Also patched was a reflected XSS^[3]
vulnerability associated with the hashtag feature, thus allowing an
adversary to pass malicious JavaScript code in the endpoint used
for searching for a specific hashtag
(“https://www[.]kooapp[.]com/tag/).

The disclosure comes a little over a month after similar
XSS-related vulnerabilities^[4] were uncovered in
Microsoft’s Edge browser, which can be exploited to trigger an
attack simply by adding a comment to a YouTube video or sending a
Facebook friend request from an account that contains non-English
language content accompanied by an XSS payload.