Feeds

XSS marks the spot: PayPal portal peril plugged

Vuln was persistent but small, claims payment firm

The Essential Guide to IT Transformation

PayPal has plugged a potentially nasty flaw on its internal portal.

The vulnerability, discovered by security analyst Benjamin Kunz Mejri of Vulnerability Laboratory, involved security shortcomings in PayPal's backend systems. More specifically, he said, it was an application-side filter bypass vulnerability in the official PayPal Ethernet portal backend application.

Before it was fixed, the flaw created a route for remote hackers to push malicious scripts onto PayPal's systems, as an advisory by the bug hunting team explains.

The filter bypass allows remote attackers to evade the regular parse and encode filter mechanism of the PayPal inc. online-service portal web-application. The persistent input validation vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable service.

Various types of attacks were possible before PayPal patched the vulnerability. For example, it might have been possible to siphon off admin/developer account data through the internal Ethernet portal. Worse still, local code execution in the Ethernet console backend portal of PayPal would also have been possible, according to Mejri.

Lastly, it might have been possible for a hacker to exert influence on what PayPal saw when they reviewed a personal profile internally.

There's no evidence that any of these attacks actually occurred.

PayPal is playing down the significance of the flaw and described it as a small but persistent XSS vulnerability. Mejri disagreed with this assessment.

In any case the flaw - rated 8.9 in severity by the industry standard CVSS (Common Vulnerability Scoring System) scheme - will earn $1,000 under PayPal's Bug Bounty programme.

In a statement, PayPal confirmed that it had plugged the security hole without going into much detail.

We can confirm that through our Bug Bounty Program, Vulnerability Lab did report a vulnerability in the internal PayPal portal, and this issue has since been fixed. PayPal takes the security of our customers’ data, money and account information extremely seriously, and that’s why we work closely with security researchers through the Bug Bounty Program as another way to help make sure their information is safe.

Mejri told El Reg that the flaw was somewhat related to a recently discovered (more serious) bug involving eBay.

"I was able to execute codes in the backend service of PayPal's Ethernet portal when reviewing my personal PayPal user profile," Mejri explained. "The same [thing] happened to eBay some weeks ago and PayPal was secured through the Ethernet but we bypassed the service to execute." ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.