Pierluigi Paganini February 25, 2019

A security expert discovered a critical cross-site scripting (XSS) flaw in Yahoo Mail that could have been exploited to steal the targeted user’s emails and attach malicious code to their outgoing messages.

Yahoo addressed a critical cross-site scripting (XSS) vulnerability in Yahoo Mail that could have been exploited by hackers to steal user’s emails and attach malicious code to their outgoing messages.

The flaw was discovered by Jouko Pynnönen, it could have exploited by a threat actor to forward the victim’s emails to an external website, change the compromised Yahoo account’s settings, and perform other malicious activities. The flaw was tied with the lack of proper filtering for malicious code in HTML emails.

Pynnönen discovered the stored XSS flaw in Yahoo Mail in early December 2018 and the company fixed it in January. Pynnönen was awarded $10,000 for this bug.

The researcher did not disclose technical details of the vulnerability because Oath, the company that owns Yahoo, has asked him to keep his findings public.

Pynnönen only explained that the exploit is related to basic HTML filtering.

This isn’t the first time that Jouko Pynnönen has discovered an XSS in Yahoo mail. In December 2015 he discovered a stored XSS vulnerability in Yahoo Mail that was awarded $10,000. In that case, the flaw could have allowed an attacker to send out emails containing hidden JavaScript code that would get executed as soon as the message was read by the victim.

One year later, Pynnönen discovered another stored XSS vulnerability in the same Mail service that could have allowed hackers to read anyone messages.

The flaw was a DOM-based persistent Cross-Site Scripting in Yahoo mail, an attacker could have exploited it to send emails embedded with malicious code. The Finnish researcher also earned $10,000

Pierluigi Paganini

(SecurityAffairs – XSS, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]