TITLE: Yoono firefox addon Persistent XSS vendor: Yoono Version: 7.7.0 Impact: Persistent XSS Software Link: https://addons.mozilla.org/en-US/firefox/addon/yoono-twitter-facebook-linkedi/ Author: r007k17-w Email: n4gb07@gmail.com Twitter: http://twitter.com/#!/r007k17w My blog: http://shadowrootkit.wordpress.com/ ------------------------------------------------------------------------------------------------------------------------------------------- DEMO: 1.Install the addon and restart comp. 2.From yonoo sidebar Login with any account(say google). 3.Online friend list is opened 4.Click 'friends' link just below the status field. 5.Pop up window 'Add friends' is seen. 6.Input random email-id,eg: qwerty@xyz.com and Create a group by selecting field.(drop down) 7.Now in the 'create' field POST DATA:"><iframe src="JavaScript:alert('XSS');></iframe> Tested On: Mozilla Firefox 10.0 Win7 Ultimate(6.1,build 7600) Solution: Input sanitization,Upgrade to next version --------------------------------------------------------------------------------------------------------------------------------------------- gr33t1ngs to s1d3-3ff3cts,L0rd CrUs4d3r,3ps1lonl4mbd4,A1-w1n6( N17|< ),1nJ3ct0rs ------------------------------------------------------------------------------------------ -----------