Details on a major vulnerability affecting Yahoo! Mail

Cenzic today published an advisory regarding a vulnerability discovered in Yahoo! Mail. This Cross-Site Scripting vulnerability allows attackers to steal Yahoo! identities and gain access to users’ sensitive and private information. Cenzic analysts alerted Yahoo! of the issue, which Yahoo! acknowledged and has completely resolved as of June 13.

The vulnerability was discovered using a Yahoo! Messenger desktop application. If a hacker successfully exploits this vulnerability, they can gain active access to the victim’s account through stealing of the session IDs. An attacker can also execute operations in Yahoo! Mail.

If the attacker is using the Yahoo! Messenger desktop application 8.1.0.209 to chat with the victim, and the victim is using the Messenger support in the new Yahoo! Mail Web application, it will cause a new chat tab to open in the victim’s browser. While chatting, the attacker can change their status to “invisible” causing a message of “offline” in the chat tab of the victim.

The vulnerability occurred when the attacker then changed status, and sent a custom message containing a malicious string in the form of a status message of “online,” with the script executed in the context of Yahoo! Mail on the victim’s machine. This allowed an attacker to get active access to the victim’s session ID, and in turn steal their Yahoo! identity, exposing sensitive personal information stored in their Yahoo! account.