full-disclosure - Yahoo Bug Bounty Program Vulnerability #2 Open Redirect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <52D1C847.3010600@t-online.de>
Date: Sat, 11 Jan 2014 23:40:07 +0100
From: Stefan Schurtz <sschurtz@...nline.de>
To: full-disclosure@...ts.grok.org.uk
Subject: Yahoo Bug Bounty Program Vulnerability #2 Open
	Redirect

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Advisory:		Yahoo Bug Bounty Program Vulnerability #2 Open Redirect
Advisory ID:		SSCHADV2013-YahooBB-002	
Author:			Stefan Schurtz
Affected Software:	Successfully tested on ads.yahoo.com
Vendor URL:		http://yahoo.com
Vendor Status:		informed

==========================
Vulnerability Description
==========================

The 'piggyback'-Parameter on "http://ads.yahoo.com" is prone to an Open
Redirect

==========================
PoC-Exploit
==========================

http://ads.yahoo.com/pixel?id=2454131&t=2&piggyback=http%3a//www.google.de&_msig=10r7s21mt&rmxbkn=26&_cbv=187571889

==========================
Solution
==========================

- -

==========================
Disclosure Timeline
==========================

13-Dec-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)
31-Dec-2013 - next message to the Yahoo Security Contact
04-Jan-2014 - feedback from vendor
04-Jan-2014 - vendor informed again about the three vulnerabilities
06-Jan-2014 - Feedback from vendor - Open redirects are no longer in
scope of the Bug Bounty program

==========================
Credits
==========================

Vulnerability found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://yahoo.com
http://www.darksecurity.de/advisories/BugBounty2013/yahoo/SSCHADV2013-YahooBB-002.tx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlLRyDsACgkQg3svV2LcbMBPlwCfYNo3J5YH+dkNKJ4fv/sOwdFA
nLMAnA8quOpgxEvymEgRJS029/Rzr2OR
=tDuT
-----END PGP SIGNATURE-----

Download attachment "0x62DC6CC0.asc" of type "application/pgp-keys" (1800 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/