WordPress Social-Stream 1.6.0 Twitter API Secret Disclosure

WordPress Social-Stream versions 1.6.0 and below suffer from a Twitter API OAuth secret disclosure vulnerability.

MD5 | 7bcdc75fa62438d580fa7352ad149ad6

Wordpress Plugin Social-Stream - Exposure of Twitter API Secret Keys
CWE-522 :Insufficiently Protected Credentials

Wordpress Social Stream
Versions 1.6.0 and lower

Social Network Tabs
Versions 1.7.4 and lower

Wordpress Social Stream, V 1.6.1

"WordPress Social Stream will combine all of your social network feeds into one
single network stream or create a single feed for multiple social
network profiles."

A weakness exists in the Wordpress plugin Social-Stream which exposes all four
Twitter API keys as parameters of a URL link on the webpage in which
the plugin widget
is rendered.


When the end user places the code in their HTML to embed a Twitter Stream feed,
it calls the file dcwp_twitter.php, where the Twitter API keys are stored.
Those keys are set as a variable, then are incorrectly echo'd onto the webpage.

$auth = new dcwss_TwitterOAuth($consumer_key,$consumer_secret,$oauth_access_token,$oauth_access_token_secret);
$get = $auth->get( $rest, $params );
} else {
echo $get;

The full and clear text URL is exposed similar to this:


Google Dork

The vendor has issued a patch for the Wordpress Social Stream, V 1.6.1
available here:

It is not known whether a patch has been issued for Social Network Tabs plugin.

An important note, the keys will remain good even after the patch,
until the end user revokes the original keys and issues a new set.
Changing one's password will not mitigate this problem, however
setting the app to be read only in Twitter will mitigate an attackers
ability to post tweets or change profile pictures as them.
Vendor notified on 04/01/2017
Fix Complete on 04/06/2017
Disclosure Public 05/21/2017
Contact: Kyle Lovett [email protected]

Related Posts