Feeds

XSS marks the spot: PayPal portal peril plugged

Vuln was persistent but small, claims payment firm

Secure remote control for conventional and virtual desktops

PayPal has plugged a potentially nasty flaw on its internal portal.

The vulnerability, discovered by security analyst Benjamin Kunz Mejri of Vulnerability Laboratory, involved security shortcomings in PayPal's backend systems. More specifically, he said, it was an application-side filter bypass vulnerability in the official PayPal Ethernet portal backend application.

Before it was fixed, the flaw created a route for remote hackers to push malicious scripts onto PayPal's systems, as an advisory by the bug hunting team explains.

The filter bypass allows remote attackers to evade the regular parse and encode filter mechanism of the PayPal inc. online-service portal web-application. The persistent input validation vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable service.

Various types of attacks were possible before PayPal patched the vulnerability. For example, it might have been possible to siphon off admin/developer account data through the internal Ethernet portal. Worse still, local code execution in the Ethernet console backend portal of PayPal would also have been possible, according to Mejri.

Lastly, it might have been possible for a hacker to exert influence on what PayPal saw when they reviewed a personal profile internally.

There's no evidence that any of these attacks actually occurred.

PayPal is playing down the significance of the flaw and described it as a small but persistent XSS vulnerability. Mejri disagreed with this assessment.

In any case the flaw - rated 8.9 in severity by the industry standard CVSS (Common Vulnerability Scoring System) scheme - will earn $1,000 under PayPal's Bug Bounty programme.

In a statement, PayPal confirmed that it had plugged the security hole without going into much detail.

We can confirm that through our Bug Bounty Program, Vulnerability Lab did report a vulnerability in the internal PayPal portal, and this issue has since been fixed. PayPal takes the security of our customers’ data, money and account information extremely seriously, and that’s why we work closely with security researchers through the Bug Bounty Program as another way to help make sure their information is safe.

Mejri told El Reg that the flaw was somewhat related to a recently discovered (more serious) bug involving eBay.

"I was able to execute codes in the backend service of PayPal's Ethernet portal when reviewing my personal PayPal user profile," Mejri explained. "The same [thing] happened to eBay some weeks ago and PayPal was secured through the Ethernet but we bypassed the service to execute." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.