# Tricky CORS Bypass in Yahoo! View

Yahoo View API reflected Origin with credentials; a backtick-encoded origin bypassed validation, letting an attacker site read authenticated session preferences.

- Payout: $500
- Severity: medium
- Program: Yahoo! / Verizon Media
- Credited: Corben Leo
- Disclosed: 2017-11-27
- Write-up quality: 7/10
- Original: https://corben.io/blog/17-11-27-tricky-CORS
- Library page: https://bugbountylibrary.com/r/blog%3Acorben-io-blog-17-11-27-tricky-cors
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:medium tech:rest technique:parser-differential vuln:access-control vuln:cors

**Target:** api.view.yahoo.com /api/session/preferences CORS endpoint
**Root cause:** Server reflected the Origin header into Access-Control-Allow-Origin with Access-Control-Allow-Credentials:true, and its origin validation accepted a backtick (%60) as a valid subdomain separator, so an attacker-controlled domain could be appended.
**Steps:**
1. Observe `GET /api/session/preferences` returns `Access-Control-Allow-Origin: https://view.yahoo.com` with `Access-Control-Allow-Credentials: true`.
2. Test origins `https://corben.io`, `https://view.corben.io`, `https://view.yahoo.com.corben.io`, `https://view.yahoo.comcorben.io` — all rejected.
3. Send `origin: https://view.yahoo.com corben.io` — server reflects it with ACAC true.
4. Replace space with `%`: `origin: https://view.yahoo.com%corben.io` — still reflected.
5. Use URL-encoded backtick: `origin: https://view.yahoo.com%60cdl.corben.io` — reflected with ACAC true.
6. Set wildcard DNS for `cdl.corben.io`, serve exploit page from `http://view.yahoo.com%60cdl.corben.io` in Safari.
7. Page issues `XMLHttpRequest` GET to `http://api.view.yahoo.com/api/session/preferences` with `withCredentials=true` and reads response.
**How found:** Browsing view.yahoo.com with Burp passive scanning revealed CORS headers reflecting Origin with credentials. After standard suffix/prefix bypasses failed, sending two space-separated domains was reflected; a tip from Matt Austin's Brave report led to trying %60 (backtick), a valid subdomain character, to make the reflected origin a resolvable attacker domain.
**Exploitation:** Victim visits attacker page at `http://view.yahoo.com%60cdl.corben.io` (only Safari parsed the backtick host); page sends credentialed XHR to the API, which trusts the reflected origin, returning the victim's session preferences to the attacker.
**Insight:** When an origin allowlist reflects the header, test characters that are valid in hostnames but not in the validator's split logic — backtick (%60), percent, and space-separated dual origins — and verify browser parsing differences (Safari accepted the backtick host where Chrome/Firefox did not).