Jouko Pynnönen, a Finnish Security researcher from safety describe solid Klikki Oy, reported a DOM based persistent XSS (Cross-Site Scripting) inwards Yahoo mail, which if exploited, allows an aggressor to ship emails embedded alongside malicious code.
In his blog post published today, the researcher demonstrated how a malicious aggressor could convey sent the victim's inbox to an external site, in addition to created a virus that attached itself to all outgoing emails past times secretly adding a malicious script to message signatures.
Since the malicious code is inwards the message's body, the code volition teach executed every bit before long every bit the victim opens the boobytrapped electronic mail in addition to its hidden payload script volition covertly submit victim's inbox content to an external website controlled past times the attacker.
"It would live on possible to embed a issue of HTML attributes that are passed through Yahoo's HTML filter in addition to treated specially," Pynnönen says inwards his spider web log post.
Pynnönen says he flora the vulnerability past times force-feeding all known HTML tags in addition to attributes inwards gild to the filter that Yahoo uses to weed out malicious HTML, only sure as shooting malicious HTML code managed to exceed through.
"As a proof of concept I supplied Yahoo Security alongside an electronic mail that, when viewed, would purpose AJAX to read the user's inbox contents in addition to ship it to the attacker's server," Pynnönen says.Pynnönen privately disclosed the vulnerability to Yahoo through its HackerOne põrnikas bounty program in addition to was awarded a $10,000 bounty.
Pynnönen reported a like vulnerability inwards the spider web version of the Yahoo! Mail service before this twelvemonth for which he earned $10,000. He too reported a stored XSS vulnerability inwards Flickr to Yahoo inwards Dec 2015 for which he earned $500.
