The first XSS STORED find in YANDEX Bug Bounty Program
Assalamualaikum Bug Hunter & Hi Everyone.
This time I want to share a finding of the XSS STORED Vulnerability on Yandex.
Previously I have tried to search for vulnerabilities in the Yandex Bug Bounty Program, and as a result I did not find any vulnerabilities in Yandex. I was frustrated, and until finally I decided to search again with more details, and finally I found my first XSS STORED on Yandex.
Let’s take your time to see this article :)
In this discovery I found 2 endpoints or 2 subdomains that were XSS STORED affected.
Alright, for the first one, I found XSS STORED in the https://files.messenger.yandex.net/ subdomain
When I try to open https://yandex.com/chat/ , then there is a Chat feature that contains the FILE ATTACHMENT feature. This feature makes me curious, because here all FILES are escaped with their respective Content-Type files. However, in the File Attachment feature there is only the Download FILE feature, and of course it will be difficult for me to see the FILE so that the FILE runs on the client side.
The first thing I prepared was the SVG file. Here’s the contents of the SVG payload:
<?xml version=”1.0" standalone=”no”?><!DOCTYPE svg PUBLIC “-//W3C//DTD SVG 1.1//EN” “http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg onload=”alert(document.domain)” xmlns=”http://www.w3.org/2000/svg"> <polygon id=”triangle” points=”0,0 0,50 50,0" fill=”#009900" stroke=”#004400"/> </svg>
File Download : https://testing13370x.000webhostapp.com/svg.html
Next I created a Chat Group, then sent an attachment containing the SVG file above.
See, the SVG file escaped successfully in the Chat attachment.
However, my steps stopped for a moment when I saw that there was only the DOWNLOAD File feature here, then when I clicked “download file”, which file will be downloaded automatically :’(
I immediately turned on the Burp Suite when making a request to download the file so that I could get the URL of the file’s LOCATION. Here are the results:
See, here is the URL for the DOWNLOAD FILE LOCATION:
I get the URL of the FILE Location, but why when I access it the FILE is automatically downloaded?
Let’s see the URL with details, and there is a Simple Technique for the solution to the problem why the FILE is automatically downloaded :)
that parameter is the main reason why my FILE auto-download :’(
Then what is the solution?
Let’s see what happens if we make a URL request without attach=true parameter :)
Open that FILE Location URL again but without attach=true
https://files.messenger.yandex.com/file_shortterm/file/3536a5ca-51a0-418e-b4ba-c85f28e41f2d
Then you will be redirected to:
And see, the SVG FILE is triggered there so XSS is also triggered :)
I smell XSS STORED here :)
Then I tried to report it to Yandex. And I’m more curious, why just bypass it. And it crossed my mind to look for the Download FILE feature on another Yandex subdomain, and I found the second XSS STORED on Yandex.
Follow me :)
The second finding is at https://disk.yandex.com/notes/
In that subdomain there is a FILE ATTACHMENT feature too :D
The first thing I tried was to upload the SVG file earlier, and lo and behold, the SVG FILE was escaped.
The next thing I did was look for the FILE LOCATION, here it’s quite easy to get the file location just by copying the file location.
Here’s the FILE LOCATION:
And in this case, it is almost the same as the first finding above, AUTOMATICALLY FILE DOWNLOAD :’(
I’m more and more curious about how to open the FILE in the Attachment feature?
When looking at the URL of the FILE LOCATION, I found a suspicion about its parameter, namely &disposition=attachment parameter
After figuring out the cause, and the final result of the solution to this problem is to remove the attachment from the &disposition= parameter.
Let’s see how it responds when attachment is removed from &disposition= parameter :)
Succeed :)
Finally I found my second XSS STORED on YANDEX.
TIMELINE :
Report : 29/11/2021
Valid : 30/11/2021
Rewards : Hall Of Fame
