I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire.

Reminds me of the MySpace worm that took the site down

Time to change your passwords!

(Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie. $() to grab an element), url shorteners and ability to include external JS mean that you can do almost anything in the 140 char payload.

Explainer:

The vulnerability is because URL's are not being escaped properly. For eg. the following URL is posted to Twitter:

  http://thisisatest.com/@"onmouseover="alert('test xss')"/

Twitter treats this as the URL. When it is parsed Twitter wraps a link around that code, so the HTML now looks like:

  <a href="http://thisisatest.com/@"onmouseover="alert('test xss')"rel/" target="_blank" ="">http://thisisatest.com/@"onmouseover="alert('test xss')"/</a></span> 

You can see that by putting in the URL and the trailing slash, Twitter thinks it has a valid URL even though it contains a quote mark in it which allows it to escape the URL attribute and include a mouse over. You can write anything to the page, including closing the link and including a script element.

You don't have to use onmouseover. You could close the link and then insert some external javascript that can re-write your tweet to make it look innocent (or hide that entire tweet), then attach a mousemove event to the body document. This means you could propagate a worm silently and without requiring a mouseover on the actual tweet.

(edit: pretty concerned about the number of people here who think that being able to inject javascript on a site in the context of a users session is not a big deal)