Yahoo addressed a critical cross-site scripting (XSS) vulnerability in Yahoo Mail that could have been exploited by hackers to steal
The flaw was discovered by Jouko Pynnönen, it could have exploited by a threat actor to forward the victim’s emails to an external website, change the compromised Yahoo account’s settings, and perform other malicious activities. The flaw was tied with the lack of proper filtering for malicious code in HTML emails.
Pynnönen discovered the stored XSS flaw in Yahoo Mail in early December 2018 and the company fixed it in January. Pynnönen was awarded $10,000 for this bug.
The researcher did not disclose technical details of the vulnerability because Oath, the company that owns Yahoo, has asked him to keep his findings public.
Pynnönen only explained that the exploit is related to basic HTML filtering.
One year later, Pynnönen discovered another stored XSS vulnerability in the same Mail service that could have allowed hackers to read anyone messages.
The flaw was a DOM-based persistent Cross-Site Scripting in Yahoo mail, an attacker could have exploited it to send emails embedded with malicious code. The Finnish researcher also earned $10,000