Expert awarded $10,000 for a new XSS flaw in Yahoo Mail

A security expert discovered a critical cross-site scripting (XSS) flaw in Yahoo Mail that could have been exploited to steal the targeted user’s emails and attach malicious code to their outgoing messages.

Yahoo addressed a critical cross-site scripting (XSS) vulnerability in Yahoo Mail that could have been exploited by hackers to steal user’s emails and attach malicious code to their outgoing messages.

The flaw was discovered by Jouko Pynnönen, it could have exploited by a threat actor to forward the victim’s emails to an external website, change the compromised Yahoo account’s settings, and perform other malicious activities. The flaw was tied with the lack of proper filtering for malicious code in HTML emails.

Pynnönen discovered the stored XSS flaw in Yahoo Mail in early December 2018 and the company fixed it in January. Pynnönen was awarded $10,000 for this bug.

The researcher did not disclose technical details of the vulnerability because Oath, the company that owns Yahoo, has asked him to keep his findings public.

Pynnönen only explained that the exploit is related to basic HTML filtering.

This isn’t the first time that Jouko Pynnönen has discovered an XSS in Yahoo mail. In December 2015 he discovered a stored XSS vulnerability in Yahoo Mail that was awarded $10,000. In that case, the flaw could have allowed an attacker to send out emails containing hidden JavaScript code that would get executed as soon as the message was read by the victim.

One year later, Pynnönen discovered another stored XSS vulnerability in the same Mail service that could have allowed hackers to read anyone messages.

The flaw was a DOM-based persistent Cross-Site Scripting in Yahoo mail, an attacker could have exploited it to send emails embedded with malicious code. The Finnish researcher also earned $10,000

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – XSS, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.