# <![CDATA[Exploiting Directory Traversal to View Customer Credit Card Information on Yahoo's Small Business Platform]]>

Directory traversal in Yahoo Small Business invoice endpoint allowed viewing other users' credit card info via email and brute-forced subscription ID.

- Payout: Research
- Severity: high
- Program: Yahoo Small Business
- Credited: Sam Curry
- Disclosed: 2017-11-10
- Write-up quality: 8/10
- Original: https://samcurry.net/exploiting-directory-traversal-on-a-yahoo-acquisition
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-exploiting-directory-traversal-on-a-yahoo-acquisition
- Tags: domain:web impact:data-leak impact:pii-leak kind:research platform:research sev:high tech:nodejs technique:chained vuln:idor vuln:path-traversal

**Target:** Node.js web application invoice and payment endpoints
**Root cause:** User-controlled path segments in invoice and payment endpoints were used to construct file paths without sanitization, allowing traversal to other users' directories.
**Steps:**
1. Identify Node.js backend via exposed template.
2. Observe that `.%2f` and `..%2f` are treated as path segments in `/my-services/invoices/INV08179455/pdf`.
3. Discover user directory naming scheme `email#vj` from error message.
4. Access own invoice via `..%2f..%2fsamwcurry@gmail.com%23vj%2finvoices%2fINV08179455/pdf`.
5. Brute-force victim's subscription number using `/order/_cart/changecart?id=../../[victimEmail]%23vj/subscriptions/[guessableVictimSubscriptionNumber]&to=bmg4a_t1m`.
6. Extract payment token from JSON response.
7. Use token in `/my-services/edit-payment-method?uid=../../[email]/paymentmethods/[payment token]` to view payment info.
**How found:** Noticed Node.js backend, tested path traversal on invoice endpoint, discovered user directory naming via error message, then found similar traversal in other endpoints and chained with brute-forcing.
**Exploitation:** Attacker needs victim's email. Brute-forces subscription number (up to 10,000 requests) via changecart endpoint to obtain payment token, then uses token in edit-payment-method endpoint to view credit card last four digits, expiration, and billing address.
**Escalation:** Chained directory traversal with brute-forcing and token extraction to escalate from path traversal to payment info disclosure.
**Insight:** When testing path traversal, look for error messages that reveal internal directory structures (like email#vj) and test other endpoints for similar patterns; brute-force predictable identifiers to escalate impact.