XSS on Yahoo Mail

[Richard Fuchshuber]

Hi,

I've noticed a strange behavior in "Yahoo! Mail" when dealing with html
attachments. It's possible to insert data into the "Yahoo! Mail" html
interface.

For example, with the following code in an html attachment it's possible
to insert "Your profile is out of date, please update clicking here" above
the button "Check Mail".

<?
<TABLE border="1" cellspacing="1" cellpadding="0">
<TR>Your profile is out of date, please update <a
href="www.blabla.com">clicking here.</a></TR>
</TABLE>

I think this could be used in phishing scam.

For a screenshot, see [1]. The circulated text was inserted into interface
of the "Yahoo! Mail" through an email with the above code as an html
attachment.

I tried to contact "Yahoo!" several times, without success.


[1] - http://richard.computeiro.com/yahoo_bug.jpg











__________________________________________________ _____
Yahoo! Acesso Grátis: Internet rápida e grátis.
Instale o discador agora!
http://br.acesso.yahoo.com/

[Will Wesley]

--- Richard Fuchshuber <richardfuch@yahoo.com.br>
schrieb:

>
> Hi,
>
> I've noticed a strange behavior in "Yahoo! Mail"
> when dealing with html
> attachments. It's possible to insert data into the
> "Yahoo! Mail" html
> interface.
>
> For example, with the following code in an html
> attachment it's possible
> to insert "Your profile is out of date, please
> update clicking here" above
> the button "Check Mail".
>
> <?
> <TABLE border="1" cellspacing="1" cellpadding="0">
> <TR>Your profile is out of date, please update <a
> href="www.blabla.com">clicking here.</a></TR>
> </TABLE>
>
> I think this could be used in phishing scam.
>
> For a screenshot, see [1]. The circulated text was
> inserted into interface
> of the "Yahoo! Mail" through an email with the
> above code as an html
> attachment.
>
> I tried to contact "Yahoo!" several times, without
> success.
>
> [1] - http://richard.computeiro.com/yahoo_bug.jpg

This is not exactly a problem with Yahoo!, but rather
a problem with the way browsers tend to render HTML
when forced to deal with broken tags. Your "<?
<table....> is not needed to accomplish the same
thing, since a browser will consider everything from <
to the next > as a tag. Since <? is not recognized the
whole thing is ignored.

The real problem is that you are injecting a TR
element into the middle of a TD, then closing the
table without first closing the TD. Any web developer
who would do such a thing is a moron, and your browser
does the best it can to make sense of it. You might
try asking Yahoo how to turn HTML off, or simply use
POP with a text only reader to work around this.

- Will Wesley, BSCS
http://wieso.blogdrive.com







__________________________________________________ _________
Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

[Steven Champeon]

on Thu, Nov 24, 2005 at 03:50:04AM +0100, Will Wesley wrote:
>
> --- Richard Fuchshuber <richardfuch@yahoo.com.br>
> schrieb:
> > <?
> > <TABLE border="1" cellspacing="1" cellpadding="0">
> > <TR>Your profile is out of date, please update <a
> > href="www.blabla.com">clicking here.</a></TR>
> > </TABLE>

<snip>

> The real problem is that you are injecting a TR
> element into the middle of a TD, then closing the
> table without first closing the TD. Any web developer
> who would do such a thing is a moron, and your browser
> does the best it can to make sense of it. You might
> try asking Yahoo how to turn HTML off, or simply use
> POP with a text only reader to work around this.

I think you missed the point. He's actually just inserting ill-formed
markup into the document flow and the browsers do react in the ways he
described to such markup. As such, the problem exists. Calling out moron
Web designers doesn't help much here. In HTML 3.2 and 4.0, for example,
an open TD tag is required, so when non-markup text follows a start TR
tag, the browser doesn't know how to deal with that text and places it
out of the table's document flow, which has the result of throwing it
further up the page, outside /and preceding/ the table in which it was
found. This is a well-known problem to Web designers (who used to use it
to troubleshoot complex table-based page layouts), but it doesn't
mitigate its importance to those concerned with preventing XSS.

Steve

--
hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com
antispam news, solutions for sendmail, exim, postfix: http://enemieslist.com/

[Will Wesley]

--- Steven Champeon <schampeo@hesketh.com> schrieb:
> I think you missed the point. He's actually just
> inserting ill-formed
> markup into the document flow and the browsers do
> react in the ways he
> described to such markup. As such, the problem
> exists. Calling out moron
> Web designers doesn't help much here. In HTML 3.2
> and 4.0, for example,
> an open TD tag is required, so when non-markup text
> follows a start TR
> tag, the browser doesn't know how to deal with that
> text and places it
> out of the table's document flow, which has the
> result of throwing it
> further up the page, outside /and preceding/ the
> table in which it was
> found. This is a well-known problem to Web designers
> (who used to use it
> to troubleshoot complex table-based page layouts),
> but it doesn't
> mitigate its importance to those concerned with
> preventing XSS.
>
> Steve

I didn't miss the point. He's actually just inserting
malformed data that the browser doesn't know what to
do with. Isn't that what I said? I only intended to
point out what the problem really was. It's not
injecting scripts to run under Yahoo's priveledges, no
information is passed to a third party, and either
some very simple social engineering or a real XSS vuln
would need to be employed to pass any information.
Calling out moron web devers is useless, I agree. But
it's just as pointless as pointing out that
incorrectly using tags is a way of troubleshooting. I
had a point with the original statement, but it
escapes me.

Anyway, a solution is really quite simple. Allow users
to disable HTML in their email, or why not by default?

- Will Wesley, BSCS
http://wieso.blogdrive.com







__________________________________________________ _________
Gesendet von Yahoo! Mail - Jetzt mit 1GB Speicher kostenlos - Hier anmelden: http://mail.yahoo.de

[Jim Ley]

"Will Wesley" <willwesleyccna@yahoo.de> wrote in message
news:20051124025004.32883.qmail@web26902.mail.ukl. yahoo.com...

>This is not exactly a problem with Yahoo!, but rather
>a problem with the way browsers tend to render HTML
>when forced to deal with broken tags.

So it's a problem with Yahoo, as they allow the email, to write to places on
the screen that is not part of the email. I agree this is certainly down to
the liberalness of the browsers parser, but that doesn't mean yahoo can
ignore it, it's just a demonstration of how difficult a job it is for people
who want to accept arbitrary HTML to be secure for their user

Of course there is a pretty simple solution, which is to just use an IFRAME,
then there's no way the email to escape into the surrounding chrome.

Jim.

[Personal Account]

Doing mouse over shows the truth.

On Wed, 2005-11-23 at 12:44, Richard Fuchshuber wrote:
> Hi,
>
> I've noticed a strange behavior in "Yahoo! Mail" when dealing with html
> attachments. It's possible to insert data into the "Yahoo! Mail" html
> interface.
>
> For example, with the following code in an html attachment it's possible
> to insert "Your profile is out of date, please update clicking here" above
> the button "Check Mail".
>
> <?
> <TABLE border="1" cellspacing="1" cellpadding="0">
> <TR>Your profile is out of date, please update <a
> href="www.blabla.com">clicking here.</a></TR>
> </TABLE>
>
> I think this could be used in phishing scam.
>
> For a screenshot, see [1]. The circulated text was inserted into interface
> of the "Yahoo! Mail" through an email with the above code as an html
> attachment.
>
> I tried to contact "Yahoo!" several times, without success.
>
>
> [1] - http://richard.computeiro.com/yahoo_bug.jpg
>
>
>
>
>
>
>
>
>
>
>
> __________________________________________________ _____
> Yahoo! Acesso Grátis: Internet rápida e grátis.
> Instale o discador agora!
> http://br.acesso.yahoo.com/
>

[little.hacker@gmail.com]

yea there is bug but it seems url doesn't work correctly.

see this http://littlehacker.persiangig.com/image/y-XSS.JPG

it will redirect to mail's first page

[Richard Fuchshuber]

Hi,

--- Will Wesley <willwesleyccna@yahoo.de> escreveu:

> This is not exactly a problem with Yahoo!, but rather
> a problem with the way browsers tend to render HTML
> when forced to deal with broken tags. Your "<?
> <table....> is not needed to accomplish the same
> thing, since a browser will consider everything from <
> to the next > as a tag. Since <? is not recognized the
> whole thing is ignored.
>
> The real problem is that you are injecting a TR
> element into the middle of a TD, then closing the
> table without first closing the TD. Any web developer
> who would do such a thing is a moron, and your browser
> does the best it can to make sense of it. You might
> try asking Yahoo how to turn HTML off, or simply use
> POP with a text only reader to work around this.

It isn't necessary to close the table, you just need the <tr></tr> part (I
had not noticed this before your mail). You can also use other tags to get
different results.

Anyway, I think that to prevent injection of HTML code into Yahoo! Mail
interface something should be done, since it could be used to fool users.


Cheers,

Richard









__________________________________________________ _____
Yahoo! Acesso Grátis: Internet rápida e grátis.
Instale o discador agora!
http://br.acesso.yahoo.com/

[alireza hassani]

--- Will Wesley <willwesleyccna@yahoo.de> wrote:
>Anyway, a solution is really quite simple.
>Allow users to disable HTML in their email, or why
not by >default?

Don't you think this is not a real solution?
User must be safe to use any option and also full
performances.

Alireza Hassani (http://www.kapda.ir)




__________________________________
Yahoo! Music Unlimited
Access over 1 million songs. Try it free.
http://music.yahoo.com/unlimited/

[Matan Peled]

little.hacker@gmail.com wrote:
> yea there is bug but it seems url doesn't work correctly.

Thats actually because you wrote:

<a href="littlehacker ...

instead of:

<a href="http://littlehacker ...

Try it like that and see it work =)

--
[Name ] :: [Matan I. Peled ]
[Location ] :: [Israel ]
[Public Key] :: [0xD6F42CA5 ]
[Keyserver ] :: [keyserver.kjsl.com]
encrypted/signed plain text preferred

[Lance James]

alireza hassani wrote:

>--- Will Wesley <willwesleyccna@yahoo.de> wrote:
>
>
>>Anyway, a solution is really quite simple.
>>Allow users to disable HTML in their email, or why
>>
>>
>not by >default?
>
>Don't you think this is not a real solution?
>User must be safe to use any option and also full
>performances.
>
>

This HTML stuff should be allowed, but controlled - similar to on blogs.
Unfortunately I have found very bad hole in the compose mail section of
yahoo when HTML is on, but that just means that they should filter
better for HTML features.

>Alireza Hassani (http://www.kapda.ir)
>
>
>
>
>__________________________________
>Yahoo! Music Unlimited
>Access over 1 million songs. Try it free.
>http://music.yahoo.com/unlimited/
>
>
>
>


--
Best Regards,
Lance James
Secure Science Corporation
www.securescience.net
Author of 'Phishing Exposed'
http://www.securescience.net/amazon/
Find out how malware is affecting your company: Get a DIA account today!
https://slam.securescience.com/signup.cgi - it's free!