A security researcher has uncovered an easy-to-exploit vulnerability in the mobile version of the Yahoo! Mail website.
Ibrahim Raafat discovered a persistent cross-site scripting (XSS) vulnerability that could have been exploited by malicious actors for various purposes.
An attacker simply needed to compose an email containing an XSS payload and send it to the targeted user. The payload would get executed as soon as the victim opened their Yahoo! Mail account from the mobile version of the website (mg.mail.yahoo.com). Raafat told SecurityWeek that the flaw did not affect the Yahoo! Mail mobile applications.
The Egypt-based researcher has pointed out that the malicious code would get executed even without the victim opening the attacker’s email – opening the inbox from the mobile version of the Yahoo! Mail website was enough for the attack to work. Raafat published a proof-of-concept (PoC) video to demonstrate his findings.
“An attacker can use this [vulnerability] to execute JavaScript on the victim’s browser. He can steal non-protected cookies, he can redirect the victim to malicious domains, or direct them to malicious files to download, or even phishing pages that ask them to enter their Yahoo credentials,” the expert said via email.
The vulnerability was reported to Yahoo! via the HackerOne platform on November 11 and it was patched on November 21. The expert told SecurityWeek that Yahoo awarded him $600 for his findings.
“The vulnerability that this reporter points out in his blog is actually a prime example of our thriving Bug Bounty program at work. At Yahoo, we’re committed to protecting our users, and we stood up the Bug Bounty program to engage with the security community to proactively identify potential vulnerabilities,” a Yahoo spokesperson said in an emailed statement.
“The security reporter in question submitted this report through our Bug Bounty system. At that time, our team reviewed the submission, confirmed the report, took immediate action to secure the vulnerability, and rewarded the security reporter for his work. We’re not aware of any impact to our users as a result of this vulnerability while it existed. We’re proud of our growing Bug Bounty program and consider it to be an important pillar in our proactive efforts to defend and protect our users,” they added.
This is not the first time Raafat has found security holes in Yahoo! services. Last year, he reported finding a series of vulnerabilities that allowed him to gain access to Flickr databases and remotely execute code on Flickr servers, for which he received a $15,000 bounty. He also identified an insecure direct object reference (IDOR) flaw that could have been exploited to delete records from a Yahoo! database.
In April 2014, the researcher discovered a stored XSS vulnerability in Google Drive, for which the search giant awarded him $1,337.
*Updated with statement from Yahoo!
Related Reading: Yahoo Mail Upgrade Sheds Passwords