RCE, Information Disclosure and XSS Flaws Found in PayPal

<div dir="ltr" style="text-align: left;" trbidi="on"> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="RCE, Information Disclosure and XSS Flaws Found in PayPal " border="0" height="218" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" title="RCE, Information Disclosure and XSS Flaws Found in PayPal " width="400" /></a></div> <br /> A security expert has managed to identify three <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a> on <a href="http://paypal-marketing.com/">paypal-marketing.com</a>, the website used by the payment processor for the <a href="http://www.hackerschronicle.com/search/label/PayPal">PayPal</a> Partner Program.<br /> <br /> Behrouz Sadeghipour has found and reported a <a href="http://www.hackerschronicle.com/search/label/XSS">cross-site scripting (XSS)</a> issue, a <a href="http://www.hackerschronicle.com/search/label/Remote%20Code%20Execution">remote code execution</a> flaw and an <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure">information disclosure vulnerability</a>.<br /> <br /> Initially, the researcher found the XSS flaw, which he reported to PayPal’s security team on March 19. The XSS was addressed on April 9.<br /> <br /> One day after the XSS was fixed, Sadeghipour identified an information disclosure issue, which he later leveraged for remote code execution. The expert said he was looking for an SQL Injection bug, but he found an RCE instead.<br /> <br /> To demonstrate the existence of the RCE to PayPal, he sent the company’s security team three links showing that he could retrieve the Process ID (PID), the script owner’s Group ID (GID) and the script owner’s User ID (UID) by replacing a parameter in the request with <a href="http://www.hackerschronicle.com/search/label/PHP">PHP</a> commands.<br /> <br /> By April 11, PayPal had addressed the vulnerability. The company has promised to reward the researcher in the next payment cycle.<br /> <br /> Sadeghipour highlights that the RCE he has found is a remote code execution, not a remote command execution bug. This vulnerability allows an attacker to run PHP functions. The flaw produces the same sort of results, but by leveraging PHP.<br /> <br /> Check out the proof-of-concept video for the PayPal Partner Program vulnerabilities. Additional technical details are available on <a href="http://nahamsec.com/2014/04/paypal-marketing-remote-code-execution/">Behrouz Sadeghipour's blog</a>.<br /> <iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/BB3rSd_muBc" width="560"></iframe><br /> Source: <a href="http://softpedia.com/">Softpedia</a></div>

Hacking News Information Disclosure News PayPal Remote Code Execution Vulnerability XSS RCE, Information Disclosure and XSS Flaws Found in PayPal

A security expert has managed to identify three vulnerabilities on paypal-marketing.com , the website used by the payment processor for...

Read more »