# CSRF leads to account takeover in Yahoo!

Yahoo subdomain's user-update API lacked CSRF tokens; a POST form with Rails _method=patch override changed victim email/password, enabling full account takeover.

- Payout: unconfirmed
- Severity: high
- Program: Yahoo! / Verizon Media
- Credited: Retr02332
- Disclosed: 2022-06-16
- Write-up quality: 7/10
- Original: https://webs3c.com/t/csrf-leads-to-account-takeover-in-yahoo/93
- Library page: https://bugbountylibrary.com/r/blog%3Awebs3c-com-t-csrf-leads-to-account-takeover-in-yahoo-93
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:ruby technique:recon technique:source-review vuln:account-takeover vuln:csrf

**Target:** Ruby on Rails user account update API endpoint (/api/v2/users/update)
**Root cause:** The user-update endpoint accepted state-changing requests without any anti-CSRF token and reflected arbitrary origins; it also honored Rails _method override and urlencoded bodies, so a plain HTML form could perform PATCH.
**Steps:**
1. Recon Yahoo subdomains not containing 'yahoo' in name; pick one running a web app.
2. Observe email-change request uses PATCH with JSON body and no CSRF token.
3. Confirm server accepts arbitrary Origin headers.
4. Change method to POST: rejected; change Content-Type to application/x-www-form-urlencoded: accepted.
5. Use Wappalyzer to identify Ruby on Rails backend.
6. Craft HTML form POSTing to `/api/v2/users/update` with hidden `_method=patch`, `user[email]=attacker@x`, `user[promo_code]=`, `user[third_party_emails]=null`; auto-submit via JS.
7. Also craft form with `_method=patch` and `password=...` to change victim password without current password.
8. Rely on Chrome's LAX+POST 2-minute window (cookie without SameSite treated as None) to send session cookie cross-site.
**How found:** Focused on non-'yahoo'-named subdomains expecting weaker security; tested the account-update feature for CSRF. Noticed PATCH method blocked HTML forms, then probed method change (failed), Content-Type change to urlencoded (succeeded), and used Wappalyzer to identify Rails, enabling _method override.
**Exploitation:** Attacker hosts a malicious page; victim visits while logged in. Auto-submitted form sends POST with _method=patch to the update endpoint, changing victim's email to attacker-controlled address and/or password. Attacker then uses password reset to the new email or the new password to log in, fully taking over the account.
**Escalation:** Chained email change (password recovery path) with direct password change (no current-password check) to guarantee full account takeover.
**Insight:** When a state-changing endpoint uses PATCH/PUT and JSON, don't stop at 'forms can't send this'—test whether the backend accepts urlencoded bodies and framework method-override params (_method for Rails, _method/X-HTTP-Method-Override elsewhere), which re-enables classic CSRF via plain HTML forms.