Yahoo! Store Security Advisory Advisory: http://securitytracker.com/id?1011403 Date: September 23, 2004 Vendor: Yahoo! Product: Yahoo! Store Status: Fixed by the vendor; Coordinated release Credit: Ben Efros benjamin@pcguy.org http://www.citiprice.com/ Description: Ben Efros reported the following vulnerability in the Yahoo! Store shopping cart to SecurityTracker on August 15, 2004. A remote user can effectively alter the price of merchandise being placed into their shopping cart. A remote user can submit modified HTML to the affected commerce site with an unauthorized item option or with a valid option that has been price-modified. The system will compute the order using the price of the option, which can be a positive or negative value. If the merchant does not review the order prior to fulfillment, the item may be sold for the incorrect price. The 'options' select item lists are intended to be used to define separately priced purchasing options, such as additional accessories, different sizes, extended warranties, and express shipping. An example of a select item option is provided: A remote user can modify the price of the select item option to an arbitrary value, even to a negative number. If an item is purchased with a negative price option selected, then the price of the order will be reduced by the negative amount selected. If a merchant does not use options, a remote user can still add an arbitrary option with an arbitrary price. Notification Timeline: August 15, 2004 - Vendor notification September 8, 2004 - Vendor fix September 8, 2004 - Merchant notification September 23, 2004 - Public advisory Solution: The vendor issued a production fix on September 8, 2004. The fix adds an "Item Options Validation" setting for merchants so that merchants can automatically reject unrecognized options. The default configuration for existing merchants is to reject unrecognized options. The vendor has described the new option at: http://help.yahoo.com/help/us/store/store-44.html SecurityTracker thanks Ben Efros for reporting this flaw and Yahoo! for their response and remediation efforts. This advisory is copyright 2004 by SecurityTracker (SecurityGlobal.net LLC). Permission is granted to redistribute this advisory in electronic form in its entirety and without modification. http://securitytracker.com/ bugs@securitytracker.com