It took Twitter about five minutes to fix a critical security flaw that allowed an attacker to download the entire source code of Vine from its servers.
Security researcher Avicoder discovered the vulnerability and reported it on Twitter on March 31.
The issue was in Docker, which is used by Twitter staff to manage Vine content.
Docker is an open platform for image management and application management in general. It can also be used to create OS images for laptops, VMs, or cloud servers
Typically, Docker installations are not accessible to the public due to the sensitive nature of the content they handle,
but it turns out Twitter's Docker was exposed, which allowed Avicoder to take a look at it.
At first glance, he discovered that Twitter was not running the latest version of Docker (v2), but an older API, version 1. Leveraging the Docker API v1 documentation website, Avicoder began testing all the commands he could find, discovering what actions he could perform.
He discovered that a few commands allowed him to search and retrieve content from Twitter's Docker settings.
Thus, the researcher discovered and downloaded over 80 server images from the Docker installation on Twitter.
He then installed several of these OS images on his laptop, using a local Docker client, and found that one of these server images contained the entire source code for the Vine service.
“I was able to see the entire Vine source code, API keys, and third-party keys,” Avicoder says.
The researcher tweeted his findings, and five minutes later, the Docker installation was fixed. The company will reward the researcher with $10,080.
