BLUE MOON SECURITY ADVISORY 2011-02
===================================


:Title: Cross site scripting vulnerability in Yahoo! Pulse
:Severity: Critical
:Reporter: Thinh Q. Hoang and Blue Moon Consulting
:Products: Yahoo! Pulse
:Fixed in: latest version


Description
-----------

Yahoo! Pulse is a new Yahoo! product that allows you to keep in touch with your friends. We’ve made it easier to stay connected to the people who matter most and share what’s important!

Yahoo! Pulse suffers from a XSS vulnerability in its photo upload feature. If the file's name is ``junk" onmouseover=alert(document.cookie) "junk.jpg``, the page is injected with JavaScript.

Workaround
----------

There is no workaround.

Fix
---

A fix has been rolled out by Yahoo!.

Disclosure
----------

Blue Moon Consulting adapts `RFPolicy v2.0 <http://www.wiretrip.net/rfp/policy.html>`_ in notifying vendors.

:Initial vendor contact:

  May 10, 2011: Initial query sent to Yahoo! Security Team (YST).

:Vendor response:

  May 11, 2011: YST asked for steps to reproduce the bug.

:Further communication:

  May 11, 2011: Details sent to YST, encrypted.

  May 12, 2011: YST sent a reply, encrypted with their PUBLIC key!

  May 12, 2011: Request sent to YST to re-send the last message.

  May 13, 2011: YST re-sent the last message.

  May 16, 2011: YST informed us the bug was fixed.

  May 17, 2011: Confirmation sent to YST.
  
:Public disclosure: May 18, 2011

:Exploit code:

  No exploit code required.

Disclaimer
----------

The information provided in this advisory is provided "as is" without warranty of any kind. Blue Moon Consulting Co., Ltd disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Your use of the information on the advisory or materials linked from the advisory is at your own risk. Blue Moon Consulting Co., Ltd reserves the right to change or update this notice at any time.


-- 
Nam Nguyen, CISA, CISSP, CSSLP
Blue Moon Consulting Co., Ltd
http://www.bluemoon.com.vn