XSS marks the spot: PayPal portal peril plugged
Vuln was persistent but small, claims payment firm
PayPal has plugged a potentially nasty flaw on its internal portal.
The vulnerability, discovered by security analyst Benjamin Kunz Mejri of Vulnerability Laboratory, involved security shortcomings in PayPal's backend systems. More specifically, he said, it was an application-side filter bypass vulnerability in the official PayPal Ethernet portal backend application.
Before it was fixed, the flaw created a route for remote hackers to push malicious scripts onto PayPal's systems, as an advisory by the bug hunting team explains.
The filter bypass allows remote attackers to evade the regular parse and encode filter mechanism of the PayPal inc. online-service portal web-application. The persistent input validation vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable service.
Various types of attacks were possible before PayPal patched the vulnerability. For example, it might have been possible to siphon off admin/developer account data through the internal Ethernet portal. Worse still, local code execution in the Ethernet console backend portal of PayPal would also have been possible, according to Mejri.
Lastly, it might have been possible for a hacker to exert influence on what PayPal saw when they reviewed a personal profile internally.
There's no evidence that any of these attacks actually occurred.
PayPal is playing down the significance of the flaw and described it as a small but persistent XSS vulnerability. Mejri disagreed with this assessment.
In any case the flaw - rated 8.9 in severity by the industry standard CVSS (Common Vulnerability Scoring System) scheme - will earn $1,000 under PayPal's Bug Bounty programme.
In a statement, PayPal confirmed that it had plugged the security hole without going into much detail.
We can confirm that through our Bug Bounty Program, Vulnerability Lab did report a vulnerability in the internal PayPal portal, and this issue has since been fixed. PayPal takes the security of our customers’ data, money and account information extremely seriously, and that’s why we work closely with security researchers through the Bug Bounty Program as another way to help make sure their information is safe.
Mejri told El Reg that the flaw was somewhat related to a recently discovered (more serious) bug involving eBay.
"I was able to execute codes in the backend service of PayPal's Ethernet portal when reviewing my personal PayPal user profile," Mejri explained. "The same [thing] happened to eBay some weeks ago and PayPal was secured through the Ethernet but we bypassed the service to execute." ®