Feeds

Under the microscope: The bug that caught PayPal with its pants down

Payment giant suffers textbook SQL injection flaw

Internet Security Threat Report 2014

Security researchers have published a more complete rundown of a recently patched SQL injection flaw on PayPal's website.

The Vulnerability Laboratory research team received a $3,000 reward after discovering a remote SQL injection web vulnerability in the official PayPal GP+ Web Application Service. The critical flaw, which could have been remotely exploitable, allowed hackers to inject commands through the vulnerable web app into the backend databases, potentially tricking them into coughing up sensitive data in the process.

The Polish security researchers reported the vulnerability to the eBay subsidiary in early January. Vulnerability Laboratory produced a proof-of-concept demo to illustrate its concerns when it reported the vulnerability to PayPal. The payment-processing outfit patched the flaw in late January.

There's no evidence that the flaw was ever abused, which is just as well since its potential impact was grave, as an advisory by Vulnerability Laboratory (extract below) explains:

The vulnerability is located in the analysis all review module with the bound vulnerable page id parameter listing. When a customer is processing to request the link to, for example, page 7 the server will include the integer value not encoded or parsed in the URL path. Attackers can exchange the integer page with their own SQL statements to compromise the application DBMS and all PayPal accounts.

The second problem is the server is bound to the main site auth which allows after a SQL and DBMS compromise via inject to exploit the bound PayPal inc services. Attackers can access all database tables and columns to steal the GP+ database content and disclose information, deface the website phish account or extract database password/username information.

The vulnerability can be exploited without user inter action but with low privileged application user account to visit the restricted webpage with a not expired session. Successful exploitation of the vulnerability results in web application context manipulation via DBMS injection, website defacement, hijack of database accounts via DBMS extract, information disclosure of database content, data lost or full DBMS compromise.

Benjamin Kunz Mejri of Vulnerability Laboratory led the research into the flaw. An advisory by the Polish researchers suggests that the vulnerability could be patched by a "secure parse of the page parameter request when processing to list via GET method" combined with changes to prevent the display of errors. It's unclear if PayPal followed this approach or identified a different way to nuke the flaw.

PayPal issued a brief and bland statement confirming that the flaw was "not impacting our website" at the time the payout for the vulnerability became public in late January. PayPal declined El Reg's invitation this week to comment on Vulnerability Laboratory's updated advisory. ®

Beginner's guide to SSL certificates

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.