Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PayPal.com XSS Vulnerability

seclists.org

Post reply on HN
Print view View original

11–20 of 79 posts

Re: PayPal.com XSS Vulnerability

#11

Post by bluetooth »

cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

Although the user has to place in the payload himself to exploit this vulnerability, there are a few ways the attacker can use this. The most obvious and simplest to do is to create a form that does the search for the user, and thus fills out the form for the user, exploiting this vulnerability. You could have the form submit automatically via javascript on page load, requiring no user interaction.

Once the form has been submitted on behalf of the user, you have javascript execution in the context of paypal.com, and can do pretty much anything. Send the contents of your account to another address, shut down the account, exfiltrate past transaction data, etc.

Re: PayPal.com XSS Vulnerability

#13

Post by bluetooth »

gingerlime wrote: post #6
cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

As an example, an attacker can craft a script that would run within the paypal.com domain name. The script can therefore potentially grab the user paypal session (if the user is already logged in). Otherwise, it can show any information the attacker wants, and to the user this looks like a real trustworthy paypal page. It is running on the paypal.com domain, and the browser shows it's secured and trusted. So for exam…

> This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users.

Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.

Re: PayPal.com XSS Vulnerability

#14

Post by psychometry »

bluetooth wrote: post #11
cft wrote: post #3

Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

Although the user has to place in the payload himself to exploit this vulnerability, there are a few ways the attacker can use this. The most obvious and simplest to do is to create a form that does the search for the user, and thus fills out the form for the user, exploiting this vulnerability. You could have the form submit automatically via javascript on page load, requiring no user interaction. Once the form has…

I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.

Re: PayPal.com XSS Vulnerability

#15

Post by AgentME »

bluetooth wrote: post #13
gingerlime wrote: post #6

Earlier quoted context omitted.

As an example, an attacker can craft a script that would run within the paypal.com domain name. The script can therefore potentially grab the user paypal session (if the user is already logged in). Otherwise, it can show any information the attacker wants, and to the user this looks like a real trustworthy paypal page. It is running on the paypal.com domain, and the browser shows it's secured and trusted. So for exam…

> This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users. Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.

It doesn't matter that the form is POST only if it doesn't do CSRF checks. (I haven't checked.)

Re: PayPal.com XSS Vulnerability

#16

Post by mattbasta »

psychometry wrote: post #14
bluetooth wrote: post #11

Earlier quoted context omitted.

Although the user has to place in the payload himself to exploit this vulnerability, there are a few ways the attacker can use this. The most obvious and simplest to do is to create a form that does the search for the user, and thus fills out the form for the user, exploiting this vulnerability. You could have the form submit automatically via javascript on page load, requiring no user interaction. Once the form has…

I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.

There's a CSRF token in the form, but deleting it doesn't seem to cause the search to fail.

Re: PayPal.com XSS Vulnerability

#17

Post by bluetooth »

AgentME wrote: post #15
bluetooth wrote: post #13

Earlier quoted context omitted.

> This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users. Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.

It doesn't matter that the form is POST only if it doesn't do CSRF checks. (I haven't checked.)

That is not what I am disputing. If there is a bug in paypal's search via POST only, you cannot link to paypal's search. You would need to link to a page you control that performs the POST automatically. If you send a link to the search that only takes parameters via POST, paypal will never receive the payload.
Post reply on HN