PayPal Patches Vulnerability That Exposed User Passwords

guest · Jan 9, 2020

PayPal Patches Vulnerability That Exposed User Passwords
January 9, 2020
https://www.securityweek.com/paypal-patches-vulnerability-exposed-user-passwords

Identified while analyzing PayPal’s main authentication flow, the issue was related to PayPal placing cross-site request forgery (CSRF) tokens and the user session ID in a JavaScript file, thus making them retrievable by attackers via cross-site script inclusion (XSSI) attacks.

An obfuscator was used to randomize variable names on each request, but one could still predict where interesting tokens are located, and then retrieve them, security researcher Alex Birsan explains.
And while the CSRF tokens and session ID could not be used to launch direct attacks, the researcher discovered a way to leverage them in an assault targeting the security challenge used by PayPal as a protection mechanism against brute force attacks.

“The response to the captcha validation request is meant to re-introduce the user into the authentication flow. To this end, it contains a self-submitting form with all the data provided in the user’s latest login request, including their email and plain text password,” Birsan explains.
Click to expand...

The Bug That Exposed Your PayPal Password - And Credit Card Number Too

A patch was applied around 24 hours later, meaning that the bug was fixed only five days after PayPal became aware of it — quite an impressive turnaround time.
While this properly fixes the vulnerability, I believe that the whole thing could have been prevented when designing the system by following one of the oldest and most important pieces of infosec advice: Never store passwords in plain text.
Click to expand...

Log in or Sign up

PayPal Patches Vulnerability That Exposed User Passwords

guest Guest

Log in or Sign up

PayPal Patches Vulnerability That Exposed User Passwords

guest Guest

Useful Searches