Yahoo! Store Security Advisory

[Stuart Moore <smoore.fd () securityglobal net>]

Yahoo! Store Security Advisory

Advisory:  http://securitytracker.com/id?1011403
Date:      September 23, 2004
Vendor:    Yahoo!
Product:   Yahoo! Store
Status:    Fixed by the vendor; Coordinated release
Credit:    Ben Efros
           benjamin () pcguy org
           http://www.citiprice.com/

Description:

Ben Efros reported the following vulnerability in the Yahoo! Store 
shopping cart to SecurityTracker <bugs () securitytracker com> on August 
15, 2004.

A remote user can effectively alter the price of merchandise being 
placed into their shopping cart.

A remote user can submit modified HTML to the affected commerce site 
with an unauthorized item option or with a valid option that has been 
price-modified.  The system will compute the order using the price of 
the option, which can be a positive or negative value.  If the merchant 
does not review the order prior to fulfillment, the item may be sold for 
the incorrect price.

The 'options' select item lists are intended to be used to define 
separately priced purchasing options, such as additional accessories, 
different sizes, extended warranties, and express shipping.

An example of a select item option is provided:

   <SELECT NAME="Express Shipping">
   <OPTION>No</OPTION>
   <OPTION>Yes (+8.95)</OPTION>
   </SELECT>

A remote user can modify the price of the select item option to an 
arbitrary value, even to a negative number.  If an item is purchased 
with a negative price option selected, then the price of the order will 
be reduced by the negative amount selected.

If a merchant does not use options, a remote user can still add an 
arbitrary option with an arbitrary price.

Notification Timeline:

August 15, 2004 - Vendor notification
September 8, 2004 - Vendor fix
September 8, 2004 - Merchant notification
September 23, 2004 - Public advisory

Solution:  The vendor issued a production fix on September 8, 2004.  The 
fix adds an "Item Options Validation" setting for merchants so that 
merchants can automatically reject unrecognized options.  The default 
configuration for existing merchants is to reject unrecognized options.

The vendor has described the new option at:

     http://help.yahoo.com/help/us/store/store-44.html

SecurityTracker thanks Ben Efros for reporting this flaw and Yahoo! for 
their response and remediation efforts.

This advisory is copyright 2004 by SecurityTracker (SecurityGlobal.net 
LLC).  Permission is granted to redistribute this advisory in electronic 
form in its entirety and without modification.

http://securitytracker.com/
bugs () securitytracker com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html