Feeds

XSS marks the spot: PayPal portal peril plugged

Vuln was persistent but small, claims payment firm

Secure remote control for conventional and virtual desktops

PayPal has plugged a potentially nasty flaw on its internal portal.

The vulnerability, discovered by security analyst Benjamin Kunz Mejri of Vulnerability Laboratory, involved security shortcomings in PayPal's backend systems. More specifically, he said, it was an application-side filter bypass vulnerability in the official PayPal Ethernet portal backend application.

Before it was fixed, the flaw created a route for remote hackers to push malicious scripts onto PayPal's systems, as an advisory by the bug hunting team explains.

The filter bypass allows remote attackers to evade the regular parse and encode filter mechanism of the PayPal inc. online-service portal web-application. The persistent input validation vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable service.

Various types of attacks were possible before PayPal patched the vulnerability. For example, it might have been possible to siphon off admin/developer account data through the internal Ethernet portal. Worse still, local code execution in the Ethernet console backend portal of PayPal would also have been possible, according to Mejri.

Lastly, it might have been possible for a hacker to exert influence on what PayPal saw when they reviewed a personal profile internally.

There's no evidence that any of these attacks actually occurred.

PayPal is playing down the significance of the flaw and described it as a small but persistent XSS vulnerability. Mejri disagreed with this assessment.

In any case the flaw - rated 8.9 in severity by the industry standard CVSS (Common Vulnerability Scoring System) scheme - will earn $1,000 under PayPal's Bug Bounty programme.

In a statement, PayPal confirmed that it had plugged the security hole without going into much detail.

We can confirm that through our Bug Bounty Program, Vulnerability Lab did report a vulnerability in the internal PayPal portal, and this issue has since been fixed. PayPal takes the security of our customers’ data, money and account information extremely seriously, and that’s why we work closely with security researchers through the Bug Bounty Program as another way to help make sure their information is safe.

Mejri told El Reg that the flaw was somewhat related to a recently discovered (more serious) bug involving eBay.

"I was able to execute codes in the backend service of PayPal's Ethernet portal when reviewing my personal PayPal user profile," Mejri explained. "The same [thing] happened to eBay some weeks ago and PayPal was secured through the Ethernet but we bypassed the service to execute." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.