Advisory: Yahoo Bug Bounty Program Vulnerability #2 Open Redirect Advisory ID: SSCHADV2013-YahooBB-002 Author: Stefan Schurtz Affected Software: Successfully tested on ads.yahoo.com Vendor URL: http://yahoo.com Vendor Status: informed ========================== Vulnerability Description ========================== The 'piggyback'-Paramter on "http://ads.yahoo.com" is prone to an Open Redirect ========================== PoC-Exploit ========================== http://ads.yahoo.com/pixel?id=2454131&t=2&piggyback=http%3a//www.google.de&_msig=10r7s21mt&rmxbkn=26&_cbv=187571889 ========================== Solution ========================== - ========================== Disclosure Timeline ========================== 13-Dec-2013 - vendor informed by contact form (Yahoo Bug Bounty Program) 31-Dec-2013 - next message to the Yahoo Securiy Contact 04-Jan-2014 - feedback from vendor 04-Jan-2014 - vendor informed again about the three vulnerabilities (which still work) 06-Jan-2014 - Feedback from vendor and last contact at the moment ========================== Credits ========================== Vulnerabilities found and advisory written by Stefan Schurtz. ========================== References ========================== http://yahoo.com http://www.darksecurity.de/advisories/BugBounty2013/yahoo/SSCHADV2013-YahooBB-002.txt