bugtraq - Yahoo mail Cross Site Scripting vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1790.68.20.178.120.1135888030.squirrel@www.morx.org>
Date: Thu, 29 Dec 2005 20:27:10 -0000 (GMT)
From: simo@...x.org
To: bugtraq@...urityfocus.com
Subject: Yahoo mail Cross Site Scripting vulnerability

Title: Yahoo mail Cross Site Scripting

Author: Simo Ben youssef aka _6mO_HaCk <simo_at_morx_org>
Date: 22 December 2005
MorX Security Research Team
http://www.morx.org

Service: Webmail

Vendor: Yahoo mail, and possibly others

Vulnerability: Cross Site Scripting / Cookie-Theft / Relogin attacks

Severity: High

Tested on: Microsoft IE 6.0

Details:

Yahoo mail filter fails to detect script attributes in combination with
the style attribute as a tag, leaving everyone using yahoo mail service
with MSIE vulnerable to Cross Site Scripting including Cookie Theft and
relogin attacks. This is a high risk security vulnerability because the
attacker wont have to make the victim click on any link, all he/she has
to do is to send the javascript code as an html email to the target and
once the victim open the email the malicious code will be executed in
his/her browser.

Impact:

an attacker can send the infiltred code as an html email to a yahoo mail
user with MSIE. Once the victim open the malicious email the javascript
content will be executed in the the target browser. This will allow user's
session cookie theft, giving the attacker access to the victim mail box
for about 24 hours (until the cookie expires) and also other types of
attacks like reloging.

Exemple of Exploit code:

<STYLE onload="alert('Yahoo mail ! cookies exploit by _6mO_HaCk, click OK
now to view your cookie ;)'); alert(document.cookie)"> </STYLE>

Screen captures:

www.morx.org/yahoo-cookie.JPG
www.morx.org/yahoo-cookie1.JPG

Solution:

Switch to firefox, or disable script execution

Vendor-status:

i didnt contact yahoo, because i contacted them previously regarding a
similar vulnerability, and yes they fixed it "silently" without even
sending me a thank you email, frankly i didnt really appreciate that.

Disclaimer:

this entire document is for eductional, testing and demonstrating purpose
only. Modification use and/or publishing this information is entirely on
your OWN risk. The exploit code is to be used on your OWN email account. I
cannot be held responsible for any of the above.

Note:

Yahoo is vulnerable to others similar vulnerabilites, that was just one
exemple of many, demonstrating how it's easy to bypass webmail filters,
for more information or details please contact me at simo_at_morx_org.