A pair of proof of concept code for a cross-site scripting (XSS) exploit involving Yahoo Mail has been discovered recently. The POC code involved in the exploit comprises of two components. The first component is a CGI script directly responsible for the exploit while the second component acts as a module that generates a URL string, which, as we’ll see later on, is critical in the execution of the exploit.

Here’s how the exploit works. The first component (which is written in Perl) is installed on a web server. This code is supposed to execute whenever a user visits a web page that is hosted on that server. The path of the CGI script on the web server is then parsed by the second component and appends a Yahoo URL string to it. An entirely new URL is generated. This URL can be sent to an unsuspecting user through an innocent-looking email or YM message. When the user clicks on the URL, his Yahoo account becomes compromised.

Fortunately this piece of POC code does nothing but display an email from the user’s inbox in a webpage that is external from Yahoo’s domain. Despite its limited functionality, the POC code has made its point that the user’s web mail account can be easily compromised by a simple click of a link. Trend detects the pair of POC exploits as EXPL_YAHOXSS.A.

If you're new here, you may want to subscribe to our RSS feed. Thanks for visiting!