Re: Yahoo Bug Bounty Program Vulnerability #3 XSS on de-mg42.mail.yahoo.com
Stefan Schurtz <[email protected]>
| Newsgroups | gmane.comp.security.full-disclosure |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Jann, you're right...bad description here (too much copy & paste) :) The XSS is cookie-based, so you can find it in the cookie with the payload. Please see "&intl=dec52a6"-alert(document.domain)-"c8d9133635e;" Kind regards, Stefan Am 08.03.2014 11:40, schrieb Jann Horn: > On Sat, Mar 08, 2014 at 11:24:03AM +0100, Stefan Schurtz wrote: >> The 'intl'-Paramter on "https://de-mg42.mail.yahoo.com/" is >> prone to a Cross-site Scripting vulnerability [...] GET >> https://de-mg42.mail.yahoo.com/neo/launch?.rand=02j5el0e9m3mr >> >> Host: de-mg42.mail.yahoo.com [...] > > Uh, where is that intl parameter you speak of? the only parameter > I see here is .rand, which, as far as I know, just serves to > circumvent caching. And where is the XSS payload? > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlMa+J0ACgkQg3svV2LcbMCRLwCfR1L1XiqxEjnT4F8Z/MYJFbLS KSoAnRQAMaK6woO866COwlK1kPsYaueu =wg9L -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
0x62DC6CC0.asc
(application/pgp-keys, 1.8 KB)
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.12 (GNU/Linux) mQGiBEi5oD4RBAD+03KasYzveqwRhr1VnOyyYwuZTa+JzyyrxHNoz+5sxVQ6fNYK XmEW4b8H/eJnSiOnSxkJqCQG00DOV0AODn57cBsTb4Ow+NVQ+ARa3TBdPNobbylt 8NU55PRXPVl160gd+LnOzQE2t3l3aNmOPVkIzN87ci1ke8vfzyf3W9bJrwCgmsug 2+Cl+7KgQ/5Nqm2Ej+Z+7GcD/0K2qtF9T61ZaR0g0uz6JQOOvBGFvUCkRMXNuqhU KEzxwR1tt1BtjEATi55KLuNsF8ZIe9FjySQtnX5bo+91lvH4wPWRI75tMLDrWm+o yLqSCAo3EMMM2RAG2XYEC/eD/Ri7LqUbdxN7PQssRJTh78pFJ1xJMms5vF/xlA9J FhlwA/94DXbeqFr0PkmHbpyRbN6VSTiA/ROb7jvn5NrVtq/LqV90bSZCr0HnbEnb LLecogq6b4Vz5URfIScF7YW4oPmnK/VjqzeZT4QgzH4pe9MnKbMETaS0saNs+fhe Gdom+jJUjXimSpKDoJYijWKsj1FPWCUTU+em7O4J/cyXn+4KSrQrc3NjaHVydHpA dC1vbmxpbmUuZGUgPHNzY2h1cnR6QHQtb25saW5lLmRlPohgBBMRAgAgAhsjBgsJ CAcDAgQVAggDBBYCAwECHgECF4AFAlI1b60ACgkQg3svV2LcbMCGRgCeNGNurYDP A/J22GMJ1IzDt7w4Od4An06QcRXfyH021UVfhmJGAukAEg1giEYEExECAAYFAkkZ AegACgkQboWE2jzBnWUd2ACgqcfpG9q6Qth7j+FNg7gK6YrzpkAAn1qTYyLV0qJU 2WQIG+FGv0KH8f91uQINBEi5oD4QCADLDYUx5h9U9mK+fhoPXaJ9kZOufvD/jmkY 7Gcnv+BY6o5+TQrPdwt9cRrDGb9N+3YL7WEsY0gNesiERZz9ZGQONoOYae427Z8f 37y/ueAEP7HGOCIqbhlvY7pt/ceomb4UkESK6x7FzkicnyECQS1SNdcEG88re35B rtFXOrAYHqXszJVAjaquKhhZyFI2aIZoGEsKBP7xI9dTwUzD5N89FpVF3CXYlmkJ VpgZGNa/FhWiuw+737sxoacElj5WcT5kWfnr8drXhuZgYhdq+fYvRTLADDZCyBAI MaQNRgaME+rjM8TC4+4O9HV4ruCatkPxQYmrtYew2pKZJfsrjrvfAAQNCACEGohg dZ7lSRC/Fe30ga77kyPGZVtcDdvLSuCvtQ2wmfmep0Q6ARHhvVBC6CC08HnkYaaK fmAWKAVMDBTwL6oLu/s1ighYW/gu53TFpXVp8BOFShwa8h20mbRdN2k9SJpAzIdt fqZI6L8ImztAV44sO+WKdsaJOisA6nc0vKBohON/pDiwF2xJCTvOh1ihMEDZPZE+ FHJ6zIuQ2kNsrrTh3Wr7QW3mD8qwMv68H6PuLaiJMPmvb62ydZqK2w1Djv8fwVUh wZ7r+Rz++IVG3qr8EYjub7MEMC8yCslNnmOWSS9B3ooCyuTYolYjoFosl9+oiFTk mSYgRRo1zb8gZd1ziE8EGBECAA8FAki5oD4CGwwFCQlmAYAACgkQg3svV2LcbMAA rACeNr7lQSP2hZKwYvIL31rnWnt4PzIAoIdS0xbqBd1ql5RLIjYaz6r+kE5Z =K6kp -----END PGP PUBLIC KEY BLOCK-----