PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Permanent account takeover on Yahoo's Small Business platform

samcurry.net | blog | #bug-bounty | #account-takeover | #authentication | #password-reset | #yahoo | #token | #security-news | #samcurry-net
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The password-reset flow on Yahoo's small business platform carried a client-controlled 'uuid'; a signature/user-ID mismatch let attackers permanently take over other users' accounts.
Published
Collected

Related coverage

blog · blog.sentry.security
Cracking Password Reset Mechanisms
Password reset tokens derived from predictable data like an MD5-hashed timestamp let attackers hijack any account including admins; use random tokens, ownership checks and rate limiting.
blog · samcurry.net
How I could've taken over the production server of a Yahoo acquisition through command injection
Following a banned researcher's trail, Sam Curry found a getImg.php endpoint on a Yahoo acquisition where command injection in image handling could have taken over the production server.
blog · samcurry.net
Eradicating image authentication injection from the entire internet
Eradicating image authentication injection: subresources answering HTTP 401 could trigger browser credential prompts; persistent reports got Safari and others to fix it, retiring a bug class.
blog · samcurry.net
How I stole the identity of every Yahoo user
How CRLF injection in Yahoo's fantasy-sports invite emails let attackers spoof and hijack messages: user-supplied names flowed into mail headers, opening identity spoofing across the platform.
blog · netspi.com
Username Discovery
Part of a login portal security series, covering how login submissions, account registration, and password reset flows can leak valid usernames through overly helpful server responses.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
Back