Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal.com XSS Vulnerability

seclists.org

Post reply on HN
Print view View original

1–10 of 79 posts

Re: PayPal.com XSS Vulnerability

#4

Post by nemothekid »

cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

I could set up a redirect to POST data to that search form and steal his cookies/replace the page with a login form/all the fun you get running arbitrary javascript.

Re: PayPal.com XSS Vulnerability

#6

Post by gingerlime »

cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

As an example, an attacker can craft a script that would run within the paypal.com domain name. The script can therefore potentially grab the user paypal session (if the user is already logged in). Otherwise, it can show any information the attacker wants, and to the user this looks like a real trustworthy paypal page. It is running on the paypal.com domain, and the browser shows it's secured and trusted. So for example, it can display the login page and asking to confirm the password, or keylog anything the user presses etc.

This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users.

Re: PayPal.com XSS Vulnerability

#7

Post by deckar01 »

nemothekid wrote: post #4
cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

I could set up a redirect to POST data to that search form and steal his cookies/replace the page with a login form/all the fun you get running arbitrary javascript.

If you can redirect someone to that page you could redirect them to any page... But they want to go to PayPal, you send them there, and you pass along some post data to hijack their session.

Re: PayPal.com XSS Vulnerability

#9

Post by pfg »

cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

Basically you need to put something like this on a page you control (where "xss code" is the code triggering the XSS):
Then, just as the page loads, submit that form and you're executing JS on a paypal.com page. This would work great for phishing or session hijacking.
Post reply on HN