9 ms·
PayPal.com XSS Vulnerability
- MysticFear 13y agoThe downside of Child Labor laws.
- icebraining 13y agoThe Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.
- droopybuns 13y agoIf the feds were to audit the situation you are describing, I would wager they'd come after Google. Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company. This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.
- beambot 13y agoCorollary: Be careful attributing to stupidity that which can be explained by laziness?
- deleted 13y ago[deleted]
- randomgerman 13y agoWhy would they come after google? A parent can make nearly any transactions for the child. And 17 year olds can take jobs, so even giving him a "job" to pay him trough that probably only would interest the tax guys ("Why are you paying some guy in germany 10k an hour" "Because we don't want to wait to long to transfer all the money" probably is problematic). If it is a problem with US law, both google and paypal have companies in the EU that could handle that.
- meowface 13y agoWhy's that? Minors can receive compensation for work they perform.
- eksith 13y agoAlso, would it even be applicable to minors working from outside the U.S?
- cft 13y agoCan you explain why this is a real vulnerability? The user himself must put that JS in the search box.
- nemothekid 13y agoI could set up a redirect to POST data to that search form and steal his cookies/replace the page with a login form/all the fun you get running arbitrary javascript.
- deckar01 13y agoIf you can redirect someone to that page you could redirect them to any page... But they want to go to PayPal, you send them there, and you pass along some post data to hijack their session.
- gingerlime 13y agoAs an example, an attacker can craft a script that would run within the paypal.com domain name. The script can therefore potentially grab the user paypal session (if the user is already logged in). Otherwise, it can show any information the attacker wants, and to the user this looks like a real trustworthy paypal page. It is running on the paypal.com domain, and the browser shows it's secured and trusted. So for example, it can display the login page and asking to confirm the password, or keylog anything the user presses etc. This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users.
- bluetooth 13y ago> This link can be embedded on a different site, or sent via email, and because the link itself points to paypal.com - it is much more likely to be trusted by unsuspecting users. Doesn't seem like that is the case here. The bug is in the search form, which is POST only. It wouldn't be enough to share the link to the search page, you'd need something that does the search on your behalf.
- deleted 13y ago[deleted]
- MarkTanamil 13y agobitcoin user not affected
- bluetooth 13y agoMtGox, BTC-e, among other big bitcoin exchanges have been hacked before.
- ethanaustinite 13y agoBitcoin is not mtgox or any other exchange. But to be fair, bitcoin itself had its share of security issues (fixed, but who knows what the future holds)
- Raynh 13y agoWhy is this interesting? Because child labor laws or because of useless Full Disclosure XSS spam that happens daily?
- jamesbrennan 13y agoIt looks like the vulnerability has been patched. Can anyone confirm if they can still successfully exploit this?
- ancarda 13y agoIs there any legitimate reason to discriminate because of age?
- droopybuns 13y agoThe Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons. This kid just blamed Paypal for one of our country's many idiotic federal laws. This choice should be considered a career limiting decision by any hiring manager.
- ancarda 13y agoCouldn't they just pay him once he turns 18? Or at the least reward him in some other way.
- lambda 13y agoOr, pay him via his parents. Somehow we manage to have child actors get paid by movie studios; there must be a way for them to be able to pay children bug bounties, if they actually wanted to.
- daurnimator 13y agoChild actor are specifically excluded from many labor laws; they also have a whole different set of special laws just for them. (Obviously this is country/state specific)
- cperciva 13y agoThis choice should be considered a career limiting decision by any hiring manager. Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?
- deleted 13y ago[deleted]
- homakov 13y ago1. seriously, you couldn't just say you're 18? nobody cares in fact. 2. well, fuck paypal! 3. not a good way to show PoC. Is there antiCSRF on search form? Can I see the whole flow?
- badgar 13y agoWhen arbitrary limits like "18+ years old to get paid to report bugs" come up, I look first to the legal system for blame. Consider that these bug bounties are going to be filed with the IRS and all that: these bug bounties are regulated, and with labor involved, it'll be more highly regulated for minors. I'm guessing there's some extra legal hassle to pay minors for their bug reports that paypal doesn't currently consider worth dealing with.
- tudorconstantin 13y agoPaypal being penny wise but pound fool. The next person who'll discover something, will probably monetize it on the black market.
- schlecht 13y agoAs so many do.
- leke 13y agoToo young to be a hacker, but not too young to jail for being a hacker :D
- cstrat 13y agoIt's weird that PayPal replaced one of the instances of </script> with </skript>?
- lawnchair_larry 13y agoNot the first time I've seen paypal flake on their bounty. Poor excuse.
- jremop 13y agoOn a sidenote, does anyone have a good setup for browsing securely to avoid issues like this? I ran with JS restricted to a whitelist for a while, but many random websites that I have to use require it these days. Can you use something like Ghostery to allow any site to do its own JS but not external JS, besides whitelisted sites/externals?
- ars 13y ago> Can you use something like Ghostery to allow any site to do its own JS but not external JS, besides whitelisted sites/externals? That's exactly what noscript does. Use the option "Temporarily allow top-level sites by default->Base 2nd level Domains".
- jremop 13y agoThanks! This looks like exactly the behavior I want.
- troels 13y agoRun your browser in private mode, or create a separate user account and run the browser under that. Or just use a different browser for the "secure stuff" (E.g. your online banking etc.). Then it doesn't matter what kind of xss trickery they throw at you, cause your cookies aren't accessible to the browser. I suppose it might be useful with a browser extension/feature that allowed you to lock access to certain site's cookies until you have explicitly granted use. Sort of like how the keychain works on os x.
- tzury 13y agoIn the last 2 years, I have seen 100's of such on paypal/ebay. Just to name a few, http://www.xssed.com/search?key=paypal.com http://www.xssed.com/search?key=paypal.com
- bharathwaaj 13y agoCan somebody explain how that script triggers?
- ck2 13y agoPayPal should have put the reward into a trust for them for a year if there were legal issues. Kudos for them being honest with both the bug and their age regardless. The future is probably filled with teenagers discovering things, good and bad. Teenagers are still prosecuted as adults but legally treated as less for other responsibilities.
- masklinn 13y agoAs x9k noted on /r/netsec (http://www.reddit.com/r/netsec/comments/1f3bt1/17_years_old_student_publicly_discloses_a/ca6euzj http://www.reddit.com/r/netsec/comments/1f3bt1/17_years_old_...) * a 12 years old found a stack overflow bug in firefox's document.write, in 2010: http://www.mercurynews.com/san-jose-neighborhoods/ci_16401891 http://www.mercurynews.com/san-jose-neighborhoods/ci_1640189... (https://news.ycombinator.com/item?id=1822117 https://news.ycombinator.com/item?id=1822117) * "Pinkie Pie" is an anonymous teenager, he won $60k at Pwnium, and did it again at Pwnium 2 * @CimStordal, 15 (at the time), found XSS in Facebook, Apple, Google and Microsoft sites: http://www.internet-security.ca/internet-security-news-archives-036/fifteen-year-old-teen-discovers-security-issues-in-google-facebook-apple-and-microsoft.html http://www.internet-security.ca/internet-security-news-archi... Tech has always been filled with teenagers discovering things, now more than ever. Most bounty handlers treat them as valued contributors, Paypal — as usual — shits all over everything.
- yogevyuval 13y agoAdd it to your CV
- Hymie 13y agoCan you clarify exactly when you reported this XSS as a personal friend of mine reported it (exact same bug with a slightly different XSS vector) and was told it had already been found a reasonable while back. (From memory, he also took a few photos of it also). Would be interested to hear your response as it might give this another angle entirely, haha. My personal experience with PayPal isn't particularly great, I'm a security researcher who's just turned 18, and even when I was underage I never actually disclosed that but regardless I had the following knocked back; (Whole heap of non-critical XSS's, and two critical stored ones, The ability to edit titles on some PayPal subdomains (without giving too much information out) - This vulnerability still exists but I was told it was quote "not serious" even though the title field was vulnerable to stored XSS. Full path disclosures, open administrative panels, whole variety of cookie/SSL/TSL based issues which I was told did not warrant a bounty. Also had a personal friend (the same guy who found the XSS you've posted here) find a couple SQLi's on a few PayPal domains (post-auth) and he still hasn't heard back from them. I'm not going to be the guy to accuse PayPal of not playing fair here, but my friend has also reported vulnerabilities I had previously reported and gotten paid for them. (Might be because he reports them from his security company email, whereas I was reporting them as an individual). Anyway, Sad to hear you didn't get a bounty! Also, if you don't have it here's a pretty good bug bounty list; http://bugcrowd.com/list-of-bug-bounty-programs/ http://bugcrowd.com/list-of-bug-bounty-programs/