What is tr.im
“tr.im is an established URL shortening service that prepares great-looking short URLs for services like Twitter. If you send URLs out on Twitter, tr.im is not only the best name, it is one of the shortest.” (tr.im about page)
tr.im can be used to send tweets with the shortened URLs through a form on their website.
tr.im is using OAuth authentication method in order to utilize the Twitter API.
Yet another Twitter shortening service. Not as popular as others in this market – 2 twits
Vulnerability: Persistent Cross-Site in tr.im Referrer statistics page.
Details: tr.im does not encode HTML entities of the referrer URLs
which can be easily manipulated by attackers, and can allow the injection of scripts.
This vulnerability can be used by an attacker to send tweets on behalf of its victims.
This vulnerability was submitted by Mike Bailey.
Vendor response rate
The vendor did not respond to any of the emails I sent during the past week – 0 twits.
Share with your friends!