Home page logo

fulldisclosure logo Full Disclosure mailing list archives

[BMSA-2011-02] Cross site scripting in Yahoo! Pulse
From: Nam Nguyen <namn () bluemoon com vn>
Date: Wed, 18 May 2011 08:23:18 +0700


:Title: Cross site scripting vulnerability in Yahoo! Pulse
:Severity: Critical
:Reporter: Thinh Q. Hoang and Blue Moon Consulting
:Products: Yahoo! Pulse
:Fixed in: latest version


Yahoo! Pulse is a new Yahoo! product that allows you to keep in touch with your friends. We’ve made it easier to stay 
connected to the people who matter most and share what’s important!

Yahoo! Pulse suffers from a XSS vulnerability in its photo upload feature. If the file's name is ``junk" 
onmouseover=alert(document.cookie) "junk.jpg``, the page is injected with JavaScript.


There is no workaround.


A fix has been rolled out by Yahoo!.


Blue Moon Consulting adapts `RFPolicy v2.0 <http://www.wiretrip.net/rfp/policy.html>`_ in notifying vendors.

:Initial vendor contact:

  May 10, 2011: Initial query sent to Yahoo! Security Team (YST).

:Vendor response:

  May 11, 2011: YST asked for steps to reproduce the bug.

:Further communication:

  May 11, 2011: Details sent to YST, encrypted.

  May 12, 2011: YST sent a reply, encrypted with their PUBLIC key!

  May 12, 2011: Request sent to YST to re-send the last message.

  May 13, 2011: YST re-sent the last message.

  May 16, 2011: YST informed us the bug was fixed.

  May 17, 2011: Confirmation sent to YST.
:Public disclosure: May 18, 2011

:Exploit code:

  No exploit code required.


The information provided in this advisory is provided "as is" without warranty of any kind. Blue Moon Consulting Co., 
Ltd disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a 
particular purpose. Your use of the information on the advisory or materials linked from the advisory is at your own 
risk. Blue Moon Consulting Co., Ltd reserves the right to change or update this notice at any time.

Blue Moon Consulting Co., Ltd

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • [BMSA-2011-02] Cross site scripting in Yahoo! Pulse Nam Nguyen (May 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]