PayPal vulnerable to cross-site scripting again
17-year old German schoolboy Robert Kugler has posted information on a cross-site scripting vulnerability in payment processing service PayPal to the Full Disclosure mailing list. Kugler wanted to report the bug to PayPal as part of its official Bug Bounty Program, but the program only pays out to participants who are 18 or over. To vent his frustration, he has now gone public with the bug.
"<SCRIPT>alert('XSS strikes again')</SCRIPT>
in the search field. The English language version of search on PayPal directs users to a different, apparently externally run, search engine. The XSS flaw could though still be of use in attacks on English speakers using PayPal.
The user has no way of knowing that code has been injected by an attacker, since the correct PayPal URL is displayed in the browser address bar and checking the SSL certificate also fails to show up any irregularities. The simple attack described by Kugler does not work with WebKit-based browsers (Safari and Chrome), which include an XSS filter. This can, however, be circumvented. Opera, Firefox and Internet Explorer users are vulnerable to the PayPal vulnerability. Mozilla developers are working on their own XSS filter, but development appears to have come to a halt.
A previous XSS vulnerability at PayPal which could be exploited using insufficiently filtered user entries was discovered back in March 2012. Then as now, the company was happy to advertise itself in Germany as a "Tested payment system" with a certificate issued by TÜV Saarland. In the last financial year, PayPal had a global turnover of $1.5 billion.