Koo vulnerable to worm attacks
Koo has identified the origin of the attack to be a stored cross-site scripting (XSS) flaw in Koo’s online application. Experts state that XSS attacks enable attackers to inject client-side scripts into vulnerable web pages viewed by other users. To cause the attack, the actor just needs to log into the service through the web app and submit an XSS-encoded payload to the timeline. Whoever sees the post will be affected through the payload.
Koo, a social media app, started it operations in November 2019. It is currently operating as an Indian homegrown alternative to Twitter. Koo has made its footprint in the market through 6 million active users. It has also gained popularity in Nigeria when Twitter was banned in the region. As per the analytics provider Sensor Tower, in the year 2020, Koo experienced 2.6 million installs from Indian app stores.
Rahul Kankrale, a Security Expert, discovered the flaw and reported it, after which Koo was prompt enough to release a patch for it. The thing that is most dangerous in this vulnerability is the XSS worm. As a result, a ripple effect comes into action where the infection spreads to all platform visitors and subsequently to other users without much intervention from them.