Yahoo Mail Account Hijacking Via Android Application Insecure Data Storage Cookies Vulnerability

Hello i'm Mohamed M.Fouad an Independent Security Researcher from Egypt. I have been got acknowledgement from many of the Firms like as Microsoft,Oracle,Yahoo,eBay,Sony,,WordPress,,ESET,Adobe,AT&T,Huawui,DropCam, Bitcasa, Get Pocket, Splitwise and so many...

   Vulnerability Description:

=====================

Hello i found an insecure data storage vulnerability in Yahoo Mail Android Application regarding "Cookies" and it can lead to account hijacking after steal cookies values and hijack victim identity so let's se POC :

I installed Yahoo Mail Android Application in emulator then i opened root shell for emulator device i navigated to yahoo application folder path as below :

=====================

ls

app_sslcache
app_webview
cache
databases
files
lib

shared_prefs
=====================
Here is the folders of the yahoo mail application locally on the device so let's go to app_webview folder . Now after i got content list of app_webview folder it contains below :
======================
ls
Cache
Cookies
Cookies-journal
Web Data
Web Data-journal

paks

======================

Cookies is sqlite DB not a folder so i extracted it . After i opened it with sqlite browser instead of sqlite console to able to see cookies values clearly 

     Here i already copied this values and paste it on notepad++

After investigation what cookies got validated after login each time i found that these values what yahoo mail validate to able to know that your session still valid or not

So i saved a cookie file from cookie manager add-on via firefox and after modify the values in the saved content of cookie manager i switched to victim account and session hijacked successfully :D

Let's see POC :

https://www.dropbox.com/home?preview=Yahoo_Insecure_Data_Storage_Vulnerability.mp4


After i reported to Yahoo it was duplicated :(

Thanks...