Paid Advertising
SLA.CKERS.ORG
HA.CKERS SLACKING
Q and A for any cross site scripting information. Feel free to ask away.
*Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: July 30, 2007 11:34PM
Hi everyone, I'm new here.
I've just discovered a serious hole of Yahoo! Mail that can lead to XSS Vulnerability. Hacker may steal Y! user's cookie under IE, or silently direct / control the account from any other browsers.
(Just edited *NEW*): Although this is Yahoo! Mail's fault, you don't need the victims to open / click anything in Yahoo! Mail. What's dangerous is: Just embed a hidden iframe anywhere, on any web page and that is. Whenever a victim visit your site, and after that login to any Y! service, they lost cookie immediately without any notice. For ex.: I embed it to BBC website, and on a nice day you surf BCC for news, after that login to your Y! Mail to check stuff, then you're done. That will happen under any version of IE. For all other browsers, cookie cannot be stolen. However instead hackers can do evil stuff at that moment (downloading your whole mail inbox and send to them...deleting all your blog entries...all depends on their imagination)
However I need you guys' advices whether I should disclose it for everyone now, or just contact Yahoo!, let them fix their problem silently and receive not even a "thanks" from them after that, like many others have experienced before? Please do give me an advice.
P.S: Just in addition, I have made a small real exploit on that hole for experiment to see how serious it is in reality, an gain cookies of 100+ Y! accounts (and increasing now) in just a few hours. My God!
Edited 6 time(s). Last edit at 08/01/2007 05:59AM by nktpro.
I've just discovered a serious hole of Yahoo! Mail that can lead to XSS Vulnerability. Hacker may steal Y! user's cookie under IE, or silently direct / control the account from any other browsers.
(Just edited *NEW*): Although this is Yahoo! Mail's fault, you don't need the victims to open / click anything in Yahoo! Mail. What's dangerous is: Just embed a hidden iframe anywhere, on any web page and that is. Whenever a victim visit your site, and after that login to any Y! service, they lost cookie immediately without any notice. For ex.: I embed it to BBC website, and on a nice day you surf BCC for news, after that login to your Y! Mail to check stuff, then you're done. That will happen under any version of IE. For all other browsers, cookie cannot be stolen. However instead hackers can do evil stuff at that moment (downloading your whole mail inbox and send to them...deleting all your blog entries...all depends on their imagination)
However I need you guys' advices whether I should disclose it for everyone now, or just contact Yahoo!, let them fix their problem silently and receive not even a "thanks" from them after that, like many others have experienced before? Please do give me an advice.
P.S: Just in addition, I have made a small real exploit on that hole for experiment to see how serious it is in reality, an gain cookies of 100+ Y! accounts (and increasing now) in just a few hours. My God!
Edited 6 time(s). Last edit at 08/01/2007 05:59AM by nktpro.
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: Anonymous User (IP Logged)
Date: July 30, 2007 11:49PM
Sounds cool, I'dd say do what you feel is right.
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: thrill (IP Logged)
Date: July 31, 2007 02:15AM
And to me, it feels right to just tell the world about it, at least you'll get some recognition.. who needs the 'thanks' when you get respect from your peers.. ;)
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: hackathology (IP Logged)
Date: July 31, 2007 10:04AM
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: July 31, 2007 10:45AM
Just one more question since i'm not experienced enough on that. Is it ILLEGAL to disclose it to the public? :-S Since this is very destructive, I have gained more than 300+ accs at this time, once disclosed that will really be a bomb! Hix...
Edited 1 time(s). Last edit at 07/31/2007 11:51AM by nktpro.
Edited 1 time(s). Last edit at 07/31/2007 11:51AM by nktpro.
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: .mario (IP Logged)
Date: July 31, 2007 02:05PM
@thrill: depends on where you live
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: thrill (IP Logged)
Date: July 31, 2007 02:24PM
Oh yeah.. don't you hate all these damn US Centric people? ;)
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: .mario (IP Logged)
Date: July 31, 2007 02:50PM
Nup - they didn't do me any wrong but I have my problems with recent German laws even if I can understand them a little bit :-/
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: sirdarckcat (IP Logged)
Date: July 31, 2007 07:03PM
As far as I understand, the problem is of where the server in which the "information" is published.. am I wrong? If I am German, and I post the information of a company of England in a USA server, can I be prosecuted? (this is just an example).
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: August 01, 2007 05:23AM
So, I still don't know what I should do with this :(
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: August 01, 2007 06:33AM
I did make a report to Yahoo! Security Staff, here is what they replied:
And I think, what I have done is right, with this reply:
Let's see how they response on that. :)
Quote:Thank you for contacting us regarding this issue. Just send the
details to this address and we'll work to reproduce and fix the
issue. If you can focus on the XSS flaw with a simple proof of
concept (e.g., alert('xss')) that will make it easier to
reproduce. Also, if you can clarify if this is an issue in
Y!Mail Classic or Y!Mail Beta as well as the hostname where the
exploit worked (e.g., us.f123.mail.yahoo.com).
And I think, what I have done is right, with this reply:
Quote:I'm more than OK to do that. However before I send the PoC and you guys fix it, I need a condition to be confirmed. Once the hole is fully agreed by your side and fully fixed, an official acknowledgment must be made by Yahoo! on that, not anything drowned in silence. It's not fair for millions of Yahoo! users when they were always at high risk before but they didn't even know about that. Many of their accounts may have been compromised using this vulnerability before, and sensitive information may have been, and being, seriously stolen and used for evil stuff. An advice from Yahoo! for users to change their password should also be made.
Some more details on this hole for you guys to make decision: Although this is Yahoo! Mail's fault, you don't need the victims to open / click anything in Yahoo! Mail. What's dangerous is: Just embed a hidden iframe anywhere, on any web page and that is. Whenever a victim visit your site, and after that login to any Y! service, they lost cookie immediately without any notice. For ex.: I embed it to BBC website, and on a nice day you surf BCC for news, after that login to your Y! Mail to check stuff, then you're done. Thousands of accounts can be easily owned in just a few hours. That will happen under any version of IE. For all other browsers, cookie cannot be stolen. However instead hackers can do evil stuff at that moment (downloading your whole mail inbox and send to them...deleting all your blog entries...all depends on their imagination). Moreover, combining this with another weak point from Yahoo! 360 (will mention on this later on) can create a highly destructive BOTNET spreading out all over Yahoo! Community. Every victim after that will be come hackers' best assistant to help stealing cookie of their own friends.
I'm waiting for your agreement.
Let's see how they response on that. :)
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: kishord (IP Logged)
Date: August 01, 2007 09:10AM
Some months ago, I had found a very serious hole in yahoo. I did not go the full disclosure way, but let me tell you, you get nothing better than a 'thank you' email.
Web Application Security Journ(ey)al
Web Application Security Journ(ey)al
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: August 01, 2007 11:46PM
No reply from them since then, if they still refuse their responsibility to notify Y! users about that, I will disclose it on my rights. Let's wait for 3 more days.
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: Ghozt (IP Logged)
Date: August 02, 2007 12:52AM
If you want it fixed overnight then contact henrit ` yahoo-inc.com
Replace ` with the AT sign.
- Ghozt
Replace ` with the AT sign.
- Ghozt
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: thejudger (IP Logged)
Date: August 09, 2007 01:53AM
bro` ... like others said i think you`ll get more respect and 10x and maybe some rewards from us than the yahoo stuff ... so my opinion is to make it public but not anywhere ... only at professional hackin` boards like this one !
Best regards,
TheJudger
Best regards,
TheJudger
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: .mario (IP Logged)
Date: August 09, 2007 07:56AM
Quote:like others said i think you`ll get more respect and 10x and maybe some rewards from us than the yahoo stuff
I'd recommend to give a crap on respect, false promises and other written junk in here. Do what you consider right and don't cross the border to criminality depending on where you live.
Greetings,
.mario
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: August 11, 2007 04:25AM
Thanks for all the comments!
Finally, I decided to co-operate with Yahoo! on this. We did make very good communication with each others. They suggested both parties should go for the RFPolicy, as also mentioned in thrill's post. They did send emails to me regularly to update on their progress of fixing this. They admitted this hole is rather complex for them to fix, and it took 1 week to finish. Yesterday, I received their email confirmed they were going to push the patch into production. Hence, it's time I can disclose the details here to share with everyone. Promise you guys will love this, 'cause you know what? This is not only Yahoo!'s mistake. Actually I did find out that plenty of other websites, especially webmails are having this problem as well. Yahoo! asked me to help testing the bug again tomorrow to se whether it's fully fixed. After that I will post the disclosure here. Wait for it guys!
Finally, I decided to co-operate with Yahoo! on this. We did make very good communication with each others. They suggested both parties should go for the RFPolicy, as also mentioned in thrill's post. They did send emails to me regularly to update on their progress of fixing this. They admitted this hole is rather complex for them to fix, and it took 1 week to finish. Yesterday, I received their email confirmed they were going to push the patch into production. Hence, it's time I can disclose the details here to share with everyone. Promise you guys will love this, 'cause you know what? This is not only Yahoo!'s mistake. Actually I did find out that plenty of other websites, especially webmails are having this problem as well. Yahoo! asked me to help testing the bug again tomorrow to se whether it's fully fixed. After that I will post the disclosure here. Wait for it guys!
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: Anonymous User (IP Logged)
Date: August 11, 2007 08:55AM
Good job, no hurry but interested of course.
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: thrill (IP Logged)
Date: August 11, 2007 02:18PM
@nktpro:
Nice job dude. You've done the right thing and I'm glad that Y! was receptive to working with you.
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Nice job dude. You've done the right thing and I'm glad that Y! was receptive to working with you.
--thrill
---
It is not the degrees you hold, but the mind you possess. - thrill
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: .mario (IP Logged)
Date: August 12, 2007 10:38AM
@nktpro: Yep - my congratulations too.
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
---
g:0in~/*for another*/~alert(!!1)
(Å='',[Ç=!(µ=!Å+Å)+{}][Ç[ª=µ[++Å]+µ[Å-Å],È=Å-~Å]+Ç[È+È]+ª])()[Ç[Å]+Ç[Å+Å]+µ[È]+ª](Å)
me || PHPIDS || Twitter || <malicious></markup>
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: DoctorDan (IP Logged)
Date: August 14, 2007 08:42PM
Nice work! I'm very interested to see its specifics. I'm glad Yahoo! did a good job with communication- sounds like they're intent on fixing it, as they should be.
-Dan
-Dan
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: anondanonymous (IP Logged)
Date: September 19, 2007 09:55AM
so is this vulnerability finally fixed?
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: hackathology (IP Logged)
Date: September 23, 2007 08:00AM
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nemessis (IP Logged)
Date: September 23, 2007 02:37PM
Is the same security problem like in my video tutorial? [sla.ckers.org]
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: nktpro (IP Logged)
Date: September 29, 2007 04:25PM
Guys,
This is the latest update from Y! Security for me. Up to now they haven't confirmed it's totally fixed yet:
This is the latest update from Y! Security for me. Up to now they haven't confirmed it's totally fixed yet:
Quote:Just an update. We have what we think is a fix deployed to
about one-third of our servers. We are receiving sporadic
reports that images are not being served correctly, likely as a
result of this change. We are working to understand the cause
and effect of that issue before finishing deployment to the
remainder of the servers. It is possible that this may require
additional code changes and a whole new push cycle, although
we're obviously hoping it does not. We'll let you know
more as we know more.
As always, please feel free to ask us any questions you
may have at any time.
Yahoo! Security Contact
Re: *Brand New* Serious Yahoo! Mail XSS Vulnerability
Posted by: Ghozt (IP Logged)
Date: September 29, 2007 05:44PM
nktpro Wrote:
-------------------------------------------------------
> Guys,
>
> This is the latest update from Y! Security for me.
> Up to now they haven't confirmed it's totally
> fixed yet:
>
> Just an update. We have what we think is a fix
> deployed to
> about one-third of our servers. We are receiving
> sporadic
> reports that images are not being served
> correctly, likely as a
> result of this change. We are working to
> understand the cause
> and effect of that issue before finishing
> deployment to the
> remainder of the servers. It is possible that
> this may require
> additional code changes and a whole new push
> cycle, although
> we're obviously hoping it does not. We'll let you
> know
> more as we know more.
>
> As always, please feel free to ask us any
> questions you
> may have at any time.
>
> Yahoo! Security Contact
If this was FD it would have been fixed 45 days ago.
- Ghozt
-------------------------------------------------------
> Guys,
>
> This is the latest update from Y! Security for me.
> Up to now they haven't confirmed it's totally
> fixed yet:
>
> Just an update. We have what we think is a fix
> deployed to
> about one-third of our servers. We are receiving
> sporadic
> reports that images are not being served
> correctly, likely as a
> result of this change. We are working to
> understand the cause
> and effect of that issue before finishing
> deployment to the
> remainder of the servers. It is possible that
> this may require
> additional code changes and a whole new push
> cycle, although
> we're obviously hoping it does not. We'll let you
> know
> more as we know more.
>
> As always, please feel free to ask us any
> questions you
> may have at any time.
>
> Yahoo! Security Contact
If this was FD it would have been fixed 45 days ago.
- Ghozt
Sorry, only registered users may post in this forum.
sla.ckers.org RSS feed
Board haX0r3d together by ha.ckers.org, forshizzle.
SecTheory Security Consulting *