Stories
Slash Boxes
Comments

SoylentNews is people

PayPal Patches Vulnerability that Exposed User Passwords

posted by Fnord666 on Sunday January 12 2020, @06:35PM   Printer-friendly
from the what's-[left]-in-your-wallet? dept.

upstart writes in with an IRC submission for Bytram:

PayPal Patches Vulnerability That Exposed User Passwords:

A researcher has earned over $15,000 from PayPal for reporting a critical vulnerability that could have been exploited by hackers to obtain user email addresses and passwords.

Identified while analyzing PayPal's main authentication flow, the issue was related to PayPal placing cross-site request forgery (CSRF) tokens and the user session ID in a JavaScript file, thus making them retrievable by attackers via cross-site script inclusion (XSSI) attacks.

An obfuscator was used to randomize variable names on each request, but one could still predict where interesting tokens are located, and then retrieve them, security researcher Alex Birsan explains.

And while the CSRF tokens and session ID could not be used to launch direct attacks, the researcher discovered a way to leverage them in an assault targeting the security challenge used by PayPal as a protection mechanism against brute force attacks.

Original Submission

 
This discussion has been archived. No new comments can be posted.
PayPal Patches Vulnerability that Exposed User Passwords | Log In/Create an Account | Top | 2 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Monday January 13 2020, @08:01PM

    by Anonymous Coward on Monday January 13 2020, @08:01PM (#942843)

    "PayPal placing cross-site request forgery (CSRF) tokens and the user session ID in a JavaScript file"

    wow, that's fucking stupid.