Feeds

XSS marks the spot: PayPal portal peril plugged

Vuln was persistent but small, claims payment firm

Protecting against web application threats using SSL

PayPal has plugged a potentially nasty flaw on its internal portal.

The vulnerability, discovered by security analyst Benjamin Kunz Mejri of Vulnerability Laboratory, involved security shortcomings in PayPal's backend systems. More specifically, he said, it was an application-side filter bypass vulnerability in the official PayPal Ethernet portal backend application.

Before it was fixed, the flaw created a route for remote hackers to push malicious scripts onto PayPal's systems, as an advisory by the bug hunting team explains.

The filter bypass allows remote attackers to evade the regular parse and encode filter mechanism of the PayPal inc. online-service portal web-application. The persistent input validation vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable service.

Various types of attacks were possible before PayPal patched the vulnerability. For example, it might have been possible to siphon off admin/developer account data through the internal Ethernet portal. Worse still, local code execution in the Ethernet console backend portal of PayPal would also have been possible, according to Mejri.

Lastly, it might have been possible for a hacker to exert influence on what PayPal saw when they reviewed a personal profile internally.

There's no evidence that any of these attacks actually occurred.

PayPal is playing down the significance of the flaw and described it as a small but persistent XSS vulnerability. Mejri disagreed with this assessment.

In any case the flaw - rated 8.9 in severity by the industry standard CVSS (Common Vulnerability Scoring System) scheme - will earn $1,000 under PayPal's Bug Bounty programme.

In a statement, PayPal confirmed that it had plugged the security hole without going into much detail.

We can confirm that through our Bug Bounty Program, Vulnerability Lab did report a vulnerability in the internal PayPal portal, and this issue has since been fixed. PayPal takes the security of our customers’ data, money and account information extremely seriously, and that’s why we work closely with security researchers through the Bug Bounty Program as another way to help make sure their information is safe.

Mejri told El Reg that the flaw was somewhat related to a recently discovered (more serious) bug involving eBay.

"I was able to execute codes in the backend service of PayPal's Ethernet portal when reviewing my personal PayPal user profile," Mejri explained. "The same [thing] happened to eBay some weeks ago and PayPal was secured through the Ethernet but we bypassed the service to execute." ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.