# Write-up - Love story, from closed as informative to $3,500 USD, XSS stored in Yahoo! iOS MaiL app

Stored XSS via SVG/XML email attachment in Yahoo! iOS Mail app let attacker read local Cache.db, exfiltrating cookies, contacts and email content.

- Payout: $3,500
- Severity: high
- Program: Yahoo! / Verizon Media
- Credited: Omar Espino
- Disclosed: 2018-09-07
- Write-up quality: 7/10
- Original: http://omespino.com/write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app/
- Library page: https://bugbountylibrary.com/r/blog%3Aomespino-com-write-up-lovestory-from-closed-as-informative-to-xx00-usd-in-yahoo-ios-mail-app
- Tags: domain:mobile impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:ios technique:chained vuln:info-disclosure vuln:xss

**Target:** Yahoo! Mail iOS app attachment renderer
**Root cause:** The iOS Mail app renders SVG/XML attachments as HTML, executing embedded <script> in the app's WebView context with access to local file paths.
**Steps:**
1. Send an email to victim with an XML/SVG attachment containing `<svg xmlns=...><script>...</script></svg>`
2. Victim opens any attachment in the email in Yahoo! Mail iOS app; the XSS fires regardless of which attachment is tapped
3. Script computes `location.href.split('Library')[0] + 'Library'` to derive app sandbox path
4. XHR GET `Library/Caches/com.yahoo.Aerogram/Cache.db` reads the local cache database
5. XHR POST the file contents to attacker server (`http://192.168.1.109:8090/`)
6. Extract cookies via `strings yahoo.db | grep -i Cookie -A 10 -B 5`
**How found:** Noticed the XML attachment rendered as HTML and the XSS fired on any attachment tap; hypothesized the WebView could issue GET requests to local app resources, then tried reading the known Cache.db path.
**Exploitation:** Attacker emails a crafted XML/SVG attachment; when victim opens any attachment the injected script runs in the app WebView, reads the local Cache.db via file:// XHR, and POSTs it to an attacker-controlled server, yielding cookies, contact list and email content.
**Escalation:** Turned an initially 'informative' XSS into full local-file read of the app cache database, escalating to cookie theft and email/contact data exfiltration.
**Insight:** Mobile mail clients that render SVG/XML attachments in a WebView often allow file:// XHR to the app sandbox; derive the sandbox path from location.href and target known cache DBs (e.g. com.yahoo.Aerogram/Cache.db) to harvest cookies.