Yahoo! Store Security Advisory

[Stuart Moore <smoore.bugtraq@xxxxxxxxxxxxxxxxxx>]

Yahoo! Store Security Advisory

Advisory:  http://securitytracker.com/id?1011403
Date:      September 23, 2004
Vendor:    Yahoo!
Product:   Yahoo! Store
Status:    Fixed by the vendor; Coordinated release
Credit:    Ben Efros
           benjamin@xxxxxxxxx
           http://www.citiprice.com/

Description:

Ben Efros reported the following vulnerability in the Yahoo! Store
shopping cart to SecurityTracker <bugs@xxxxxxxxxxxxxxxxxxx> on August
15, 2004.

A remote user can effectively alter the price of merchandise being
placed into their shopping cart.

A remote user can submit modified HTML to the affected commerce site
with an unauthorized item option or with a valid option that has been
price-modified.  The system will compute the order using the price of
the option, which can be a positive or negative value.  If the merchant
does not review the order prior to fulfillment, the item may be sold for
the incorrect price.

The 'options' select item lists are intended to be used to define
separately priced purchasing options, such as additional accessories,
different sizes, extended warranties, and express shipping.

An example of a select item option is provided:

   <SELECT NAME="Express Shipping">
   <OPTION>No</OPTION>
   <OPTION>Yes (+8.95)</OPTION>
   </SELECT>

A remote user can modify the price of the select item option to an
arbitrary value, even to a negative number.  If an item is purchased
with a negative price option selected, then the price of the order will
be reduced by the negative amount selected.

If a merchant does not use options, a remote user can still add an
arbitrary option with an arbitrary price.

Notification Timeline:

August 15, 2004 - Vendor notification
September 8, 2004 - Vendor fix
September 8, 2004 - Merchant notification
September 23, 2004 - Public advisory

Solution:  The vendor issued a production fix on September 8, 2004.  The
fix adds an "Item Options Validation" setting for merchants so that
merchants can automatically reject unrecognized options.  The default
configuration for existing merchants is to reject unrecognized options.

The vendor has described the new option at:

     http://help.yahoo.com/help/us/store/store-44.html

SecurityTracker thanks Ben Efros for reporting this flaw and Yahoo! for
their response and remediation efforts.

This advisory is copyright 2004 by SecurityTracker (SecurityGlobal.net
LLC).  Permission is granted to redistribute this advisory in electronic
form in its entirety and without modification.

http://securitytracker.com/
bugs@xxxxxxxxxxxxxxxxxxx