Connect with us

Hi, what are you looking for?



Yahoo Rewards Researcher for ImageMagick Hack

Yahoo rewarded a bug bounty hunter after he demonstrated that a recently disclosed ImageMagick vulnerability could be exploited for remote code execution on a website acquired by the company last year.

Yahoo rewarded a bug bounty hunter after he demonstrated that a recently disclosed ImageMagick vulnerability could be exploited for remote code execution on a website acquired by the company last year.

Earlier this month, researchers revealed that the popular image-processing suite ImageMagick is plagued by a serious vulnerability that allows attackers to execute arbitrary code on vulnerable servers by uploading a specially crafted image file. The flaw, tracked as CVE-2016-3714 and dubbed “ImageTragick,” can be exploited to target websites that allow users to upload images, such as profile pictures.

Some of the exploits seen in the wild are only designed for reconnaissance, but security firms have also spotted more dangerous exploits that can give attackers full access to targeted servers.

California-based researcher Behrouz Sadeghipour discovered last week that the ImageMagick vulnerability plagued Polyvore, a community-powered social commerce website acquired by Yahoo last year.

Since Polyvore allows users to upload profile pictures, Sadeghipour uploaded an ImageTragick proof-of-concept (PoC) file to show how an attacker could have executed arbitrary code on the server.

Yahoo was notified on May 4 and patched the vulnerability within three hours. Since the Polyvore website was recently added to Yahoo’s bug bounty program, the company awarded Sadeghipour $2,000 for his findings.

The expert believes the flaw should have been worth more considering the access it provided. Yahoo told SecurityWeek that the primary factors in determining the amount of a bug bounty are the depth and impact of the vulnerability.

Yahoo is offering rewards of up to $15,000 as part of its bug bounty program. The company said it paid out $1.6 million in bug bounties over the last two years.

Advertisement. Scroll to continue reading.

This was not the first time Sadeghipour reported vulnerabilities to Yahoo. In the past, he informed the company of a SSRF (server-side request forgery) vulnerability in its image processing system, and a Yahoo Toolbar issue that generated a stored XSS (cross-site scripting) flaw in several major online services.

Related: Stored XSS Found in Yahoo! Mail for Mobile

Related: Researcher Earns $10,000 for Yahoo! Mail Flaw

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Former DoD CISO Jack Wilmer has been named CEO of defensive and offensive cyber solutions provider SIXGEN.

Certificate lifecycle management firm Sectigo has hired Jason Scott as its CISO.

The State of Vermont has appointed John Toney as the state’s new CISO.

More People On The Move

Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.