Application security, Compliance Management, Network Security, Privacy, Vulnerability Management

Yahoo awards $7K for Flickr account takeover flaw

Yahoo awarded a $7,000 bug bounty to a researcher who spotted three vulnerabilities that could be leveraged to takeover a Flickr account.

Researcher Michael Reizelman reported the flaw, which could allow an attacker to circumvent the social media platform's protections to intercept and grab access tokens to Flickr's parent company Yahoo via its HackerOne account on April 2, according to an April 29 blog post.

The vulnerability was caused by the method in which Flickr authentication is handled by the Yahoo login domain which allowed Reizelman to force the service to send him an authentication token for a logged in user.

Yahoo resolved the issue by making the done parameter on the login.yahoo.com endpoint only allow https://www.flickr.com/signin/yahoo/ as a valid value, fixing the image embedding logic bypass, and applying CSP to the Flickr forum. The vulnerability was patched by April 21.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.