PayPal.com XSS Vulnerability(seclists.org)
seclists.org
PayPal.com XSS Vulnerability
http://seclists.org/fulldisclosure/2013/May/163
78 comments
As x9k noted on /r/netsec (http://www.reddit.com/r/netsec/comments/1f3bt1/17_years_old_...)
* a 12 years old found a stack overflow bug in firefox's document.write, in 2010: http://www.mercurynews.com/san-jose-neighborhoods/ci_1640189... (https://news.ycombinator.com/item?id=1822117)
* "Pinkie Pie" is an anonymous teenager, he won $60k at Pwnium, and did it again at Pwnium 2
* @CimStordal, 15 (at the time), found XSS in Facebook, Apple, Google and Microsoft sites: http://www.internet-security.ca/internet-security-news-archi...
Tech has always been filled with teenagers discovering things, now more than ever. Most bounty handlers treat them as valued contributors, Paypal — as usual — shits all over everything.
* a 12 years old found a stack overflow bug in firefox's document.write, in 2010: http://www.mercurynews.com/san-jose-neighborhoods/ci_1640189... (https://news.ycombinator.com/item?id=1822117)
* "Pinkie Pie" is an anonymous teenager, he won $60k at Pwnium, and did it again at Pwnium 2
* @CimStordal, 15 (at the time), found XSS in Facebook, Apple, Google and Microsoft sites: http://www.internet-security.ca/internet-security-news-archi...
Tech has always been filled with teenagers discovering things, now more than ever. Most bounty handlers treat them as valued contributors, Paypal — as usual — shits all over everything.
Not the first time I've seen paypal flake on their bounty. Poor excuse.
Too young to be a hacker, but not too young to jail for being a hacker :D
Paypal being penny wise but pound fool.
The next person who'll discover something, will probably monetize it on the black market.
The next person who'll discover something, will probably monetize it on the black market.
As so many do.
Is there any legitimate reason to discriminate because of age?
The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons.
This kid just blamed Paypal for one of our country's many idiotic federal laws.
This choice should be considered a career limiting decision by any hiring manager.
This kid just blamed Paypal for one of our country's many idiotic federal laws.
This choice should be considered a career limiting decision by any hiring manager.
This choice should be considered a career limiting decision by any hiring manager.
Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
I find the meaning and knowledge of laws to be inaccessible overall as a 18+ citizen. I'm not American, but who for instance knew that there were "provisions" under the Federal Labor Standards Act?
[deleted]
It makes me angry, but the law here in the US is that "ignorance is not a defense." Oh... you didn't know our several million laws when you broke one? Too bad, they say. Lawyers counter that if the law was simpler, they wouldn't have jobs.
Yes, but US labor laws don't apply to someone living in Germany anyway.
Ok. Now if only the kid actually was over there in the US.
It's not that simple. When you access an American network, your usage is governed my American laws -- period.
You make it sound like if you hacked into Paypal from Germany you'd be completely immune to American law on the matter because you're not in the US.
That's simply not true.
You make it sound like if you hacked into Paypal from Germany you'd be completely immune to American law on the matter because you're not in the US.
That's simply not true.
[deleted]
They didn't have to pay him.
Still very poorly handled. Should've gone something like:
1. "Hey, that's awesome that you found that, thanks!"
2. "For very good reasons (a), (b) and (c) we can't actually pay you, that really sucks :("
3. "But hey we like your style, so how about we fly you over for an internship when you've finished school / investigate if Germany has different rules / look at scholorship options and a great reference / [one of a million other things you could do to help a kid out"
Still very poorly handled. Should've gone something like:
1. "Hey, that's awesome that you found that, thanks!"
2. "For very good reasons (a), (b) and (c) we can't actually pay you, that really sucks :("
3. "But hey we like your style, so how about we fly you over for an internship when you've finished school / investigate if Germany has different rules / look at scholorship options and a great reference / [one of a million other things you could do to help a kid out"
I totally agree, and they have the ability to give him the money. All they would have to do is ask for a parent to represent him.
IANAL.. but I can't see how asking a parent to represent him would relieve PayPal of complying with labor standards for minors... he's still the one doing the work.. and advising him to have a parent represent him is just written proof that they knew.
internship for $300k / year would be appropriate
"This choice should be considered a career limiting decision by any hiring manager."
Hopefully not forever. When I was young and stupid and the net was a much simpler place I casually fully disclosed the problem with posting your Cisco configs with "encrypted" passwords to Usenet:
https://groups.google.com/d/msg/comp.dcom.sys.cisco/WjuKAOQL...
I would not do something like this today, especially not in such a full-of-myself douchey manner.
Sadly a lot of postings to the internet are basically "forever" at this point and combined with the insistence of so many companies that real names be used, we're going to have generations of younger folks who say or do something stupid (because they are young and stupid) that they can never get rid of. And that's unfortunate.
Hopefully not forever. When I was young and stupid and the net was a much simpler place I casually fully disclosed the problem with posting your Cisco configs with "encrypted" passwords to Usenet:
https://groups.google.com/d/msg/comp.dcom.sys.cisco/WjuKAOQL...
I would not do something like this today, especially not in such a full-of-myself douchey manner.
Sadly a lot of postings to the internet are basically "forever" at this point and combined with the insistence of so many companies that real names be used, we're going to have generations of younger folks who say or do something stupid (because they are young and stupid) that they can never get rid of. And that's unfortunate.
just an FYI, you can (even if you don't have the email anymore) get old posts removed from google groups, you have to jump through a bunch of hoops, but it isn't too hard to do. Just read around. I had to cover for 18 year old me posting god knows what on usenets several years ago. I did this when google first bought deja news however, you can likely get them to remove it.
who knew people were saving stuff back in 94-95. hell anyway 18 year old me didn't care, but luckily I can cover for him.
who knew people were saving stuff back in 94-95. hell anyway 18 year old me didn't care, but luckily I can cover for him.
"Hopefully not forever."
I completely agree. I also think that this kind of post on full-disclosure should be used as an example of what-not-to-do.
I've always treated vuln reward programs as resume enhancers. If you submit a bug and get it fixed, you get to show two incredibly valuable and rare skills in the infosec community:
1) technical chops 2) interpersonal skill
Disclosers who have the patience to endure some of the bullshit that comes up in these programs are going to be successful in the security industry. The hardest problems in infosec are not technical. They are cultural. Publicly flaming a vuln reward program because they didn't pay you for what you see as an arbitrary reason is exactly the kind of reason execs do not want to do vuln reward programs. Someone had to fight to get that program set up at paypal. It had to be within the laws of the country that governs the company. This kid just through a temper tantrum in public and signed his name on the email. Any advocates he had at paypal are probably re-evaluating their support of him. So short sighted.
I completely agree. I also think that this kind of post on full-disclosure should be used as an example of what-not-to-do.
I've always treated vuln reward programs as resume enhancers. If you submit a bug and get it fixed, you get to show two incredibly valuable and rare skills in the infosec community:
1) technical chops 2) interpersonal skill
Disclosers who have the patience to endure some of the bullshit that comes up in these programs are going to be successful in the security industry. The hardest problems in infosec are not technical. They are cultural. Publicly flaming a vuln reward program because they didn't pay you for what you see as an arbitrary reason is exactly the kind of reason execs do not want to do vuln reward programs. Someone had to fight to get that program set up at paypal. It had to be within the laws of the country that governs the company. This kid just through a temper tantrum in public and signed his name on the email. Any advocates he had at paypal are probably re-evaluating their support of him. So short sighted.
The Fair Labor Standards Act places no limitations on the work of 16 and 17 year olds in non-hazardous jobs, and in any case does not concern itself with non-employment relationships like the one Paypal would have had with this 17-year-old.
There is a reason that you read about minors running their own businesses all the time. The laws are targeted at employment that is exploitative or interferes with a child's education. Not at things like this.
There is a reason that you read about minors running their own businesses all the time. The laws are targeted at employment that is exploitative or interferes with a child's education. Not at things like this.
Couldn't they just pay him once he turns 18? Or at the least reward him in some other way.
Or, pay him via his parents. Somehow we manage to have child actors get paid by movie studios; there must be a way for them to be able to pay children bug bounties, if they actually wanted to.
Child actor are specifically excluded from many labor laws; they also have a whole different set of special laws just for them.
(Obviously this is country/state specific)
(Obviously this is country/state specific)
Wait, it's considered "working for" when there's no employment relationship of any kind?
I doubt it has to do with labor laws, specifically.
Payment is paid through a verified Paypal account, which you must be 18 years of age to use their services according to their user agreement.
Payment is paid through a verified Paypal account, which you must be 18 years of age to use their services according to their user agreement.
I'm pretty sure he could have found some adult to receive the money for him, if it had been offered as a possibility.
Can't they just post him a cheque?
Yeah, that's what puzzled me as well.
Can they frame the bounty not as a payment? But like some kind of prize etc.
How do those apply in Germany? Do all subsidiaries in all countries have to follow FLSA? I assume Paypal's German subsidiary is only responsible for following German employment law.
[deleted]
You should try not coming up with bad reasons to not hire qualified candidates.
The downside of Child Labor laws.
The Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.
If the feds were to audit the situation you are describing, I would wager they'd come after Google.
Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company.
This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.
Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company.
This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.
Corollary: Be careful attributing to stupidity that which can be explained by laziness?
Why would they come after google? A parent can make nearly any transactions for the child. And 17 year olds can take jobs, so even giving him a "job" to pay him trough that probably only would interest the tax guys ("Why are you paying some guy in germany 10k an hour" "Because we don't want to wait to long to transfer all the money" probably is problematic).
If it is a problem with US law, both google and paypal have companies in the EU that could handle that.
[deleted]
Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.
Basically you need to put something like this on a page you control (where "xss code" is the code triggering the XSS):
<form action="https://www.paypal.com/de/cgi-bin/searchscr?cmd=_sitewide-search" method="post">
<input type="text" name="queryString" value="xss code" />
</form>
Isn't this CSRF?
Combination of XSS and CSRF.
This seems like it's just plain XSS - it doesn't take advantage of a user's serverside session to forge an action on their behalf.
As an example, an attacker can craft a script that would run within the paypal.com domain name. The script can therefore potentially grab the user paypal session (if the user is already logged in). Otherwise, it can show any information the attacker wants, and to the user this looks like a real trustworthy paypal page. It is running on the paypal.com domain, and the browser shows it's secured and trusted. So for example, it can display the login page and asking to confirm the password, or keylog anything the user presses etc.
This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users.
This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users.
> This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users.
Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.
Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.
It doesn't matter that the form is POST only if it doesn't do CSRF checks. (I haven't checked.)
That is not what I am disputing. If there is a bug in paypal's search via POST only, you cannot link to paypal's search. You would need to link to a page you control that performs the POST automatically. If you send a link to the search that only takes parameters via POST, paypal will never receive the payload.
if the paypal search only accept POSTs then you're absolutely right. It won't be as easy as sharing a link. If it happens to also accept GET requests, then it would. I didn't test this.
Note that _if_ the form is already CSRF-protected, then attackers won't easily be able to POST from a different domain either, which would drastically reduce the attack surface.
I didn't test this, but I'm not sure the form is fully CSRF protected though. I tried to explain the potential exploit from this discovered vulnerability. Perhaps I should have stated more clearly that this is more a general comment, and not specific to this particular case.
Note that _if_ the form is already CSRF-protected, then attackers won't easily be able to POST from a different domain either, which would drastically reduce the attack surface.
I didn't test this, but I'm not sure the form is fully CSRF protected though. I tried to explain the potential exploit from this discovered vulnerability. Perhaps I should have stated more clearly that this is more a general comment, and not specific to this particular case.
I'm not sure whether you'd still have access to cookies, but it's entirely feasible to include a script which will then submit the POST request.
Although the user has to place in the payload himself to exploit this vulnerability, there are a few ways the attacker can use this. The most obvious and simplest to do is to create a form that does the search for the user, and thus fills out the form for the user, exploiting this vulnerability. You could have the form submit automatically via javascript on page load, requiring no user interaction.
Once the form has been submitted on behalf of the user, you have javascript execution in the context of paypal.com, and can do pretty much anything. Send the contents of your account to another address, shut down the account, exfiltrate past transaction data, etc.
Once the form has been submitted on behalf of the user, you have javascript execution in the context of paypal.com, and can do pretty much anything. Send the contents of your account to another address, shut down the account, exfiltrate past transaction data, etc.
I'm sure PayPal is using some form or CSRF protection to prevent a POST from some external site from working.
I could set up a redirect to POST data to that search form and steal his cookies/replace the page with a login form/all the fun you get running arbitrary javascript.
If you can redirect someone to that page you could redirect them to any page...
But they want to go to PayPal, you send them there, and you pass along some post data to hijack their session.
In the last 2 years, I have seen 100's of such on paypal/ebay.
Just to name a few, http://www.xssed.com/search?key=paypal.com
Just to name a few, http://www.xssed.com/search?key=paypal.com
Can you clarify exactly when you reported this XSS as a personal friend of mine reported it (exact same bug with a slightly different XSS vector) and was told it had already been found a reasonable while back.
(From memory, he also took a few photos of it also).
Would be interested to hear your response as it might give this another angle entirely, haha.
My personal experience with PayPal isn't particularly great, I'm a security researcher who's just turned 18, and even when I was underage I never actually disclosed that but regardless I had the following knocked back;
(Whole heap of non-critical XSS's, and two critical stored ones, The ability to edit titles on some PayPal subdomains (without giving too much information out) - This vulnerability still exists but I was told it was quote "not serious" even though the title field was vulnerable to stored XSS.
Full path disclosures, open administrative panels, whole variety of cookie/SSL/TSL based issues which I was told did not warrant a bounty.
Also had a personal friend (the same guy who found the XSS you've posted here) find a couple SQLi's on a few PayPal domains (post-auth) and he still hasn't heard back from them.
I'm not going to be the guy to accuse PayPal of not playing fair here, but my friend has also reported vulnerabilities I had previously reported and gotten paid for them. (Might be because he reports them from his security company email, whereas I was reporting them as an individual).
Anyway, Sad to hear you didn't get a bounty!
Also, if you don't have it here's a pretty good bug bounty list; http://bugcrowd.com/list-of-bug-bounty-programs/
(From memory, he also took a few photos of it also).
Would be interested to hear your response as it might give this another angle entirely, haha.
My personal experience with PayPal isn't particularly great, I'm a security researcher who's just turned 18, and even when I was underage I never actually disclosed that but regardless I had the following knocked back;
(Whole heap of non-critical XSS's, and two critical stored ones, The ability to edit titles on some PayPal subdomains (without giving too much information out) - This vulnerability still exists but I was told it was quote "not serious" even though the title field was vulnerable to stored XSS.
Full path disclosures, open administrative panels, whole variety of cookie/SSL/TSL based issues which I was told did not warrant a bounty.
Also had a personal friend (the same guy who found the XSS you've posted here) find a couple SQLi's on a few PayPal domains (post-auth) and he still hasn't heard back from them.
I'm not going to be the guy to accuse PayPal of not playing fair here, but my friend has also reported vulnerabilities I had previously reported and gotten paid for them. (Might be because he reports them from his security company email, whereas I was reporting them as an individual).
Anyway, Sad to hear you didn't get a bounty!
Also, if you don't have it here's a pretty good bug bounty list; http://bugcrowd.com/list-of-bug-bounty-programs/
On a sidenote, does anyone have a good setup for browsing securely to avoid issues like this? I ran with JS restricted to a whitelist for a while, but many random websites that I have to use require it these days.
Can you use something like Ghostery to allow any site to do its own JS but not external JS, besides whitelisted sites/externals?
Can you use something like Ghostery to allow any site to do its own JS but not external JS, besides whitelisted sites/externals?
> Can you use something like Ghostery to allow any site to do its own JS but not external JS, besides whitelisted sites/externals?
That's exactly what noscript does. Use the option "Temporarily allow top-level sites by default->Base 2nd level Domains".
That's exactly what noscript does. Use the option "Temporarily allow top-level sites by default->Base 2nd level Domains".
Thanks! This looks like exactly the behavior I want.
Run your browser in private mode, or create a separate user account and run the browser under that. Or just use a different browser for the "secure stuff" (E.g. your online banking etc.). Then it doesn't matter what kind of xss trickery they throw at you, cause your cookies aren't accessible to the browser.
I suppose it might be useful with a browser extension/feature that allowed you to lock access to certain site's cookies until you have explicitly granted use. Sort of like how the keychain works on os x.
I suppose it might be useful with a browser extension/feature that allowed you to lock access to certain site's cookies until you have explicitly granted use. Sort of like how the keychain works on os x.
It looks like the vulnerability has been patched. Can anyone confirm if they can still successfully exploit this?
It's weird that PayPal replaced one of the instances of </script> with </skript>?
[deleted]
Can somebody explain how that script triggers?
Add it to your CV
bitcoin user not affected
MtGox, BTC-e, among other big bitcoin exchanges have been hacked before.
Bitcoin is not mtgox or any other exchange. But to be fair, bitcoin itself had its share of security issues (fixed, but who knows what the future holds)
Kudos for them being honest with both the bug and their age regardless.
The future is probably filled with teenagers discovering things, good and bad.
Teenagers are still prosecuted as adults but legally treated as less for other responsibilities.