Security expert discovered a way to hack a PayPal server by exploiting a Remote Code Execution flaw affecting the Java Debug Wire Protocol (JDWP) protocol.
Security researcher Milan A Solanki discovered a new critical remote code execution vulnerability in PayPal platform. An attacker could exploit the vulnerability to execute arbitrary code on the PayPal Marketing online-service web-application server, the flaw has been rated Critical by Vulnerability Lab with a CVSS count of 9.3.
Solanki reported the flaw to the Paypal developer team that promptly fixed it.
The Remote Code Execution flaw affects the Java Debug Wire Protocol (JDWP) protocol of the PayPal marketing online service web-server, as explained by Oracle this optional protocol it used for communication between a debugger and the Java virtual machine (VM) which it debugs.
One year ago security researcher at IOActive Christophe Alladoum published an interesting post titled “Hacking the Java Debug Wire Protocol – or – “How I met your Java debugger”. The JDWP does not implement any authentication mechanism, this allows an attacker to execute arbitrary code remotely onto the affected Web server.
The vulnerability in PayPal platform is very dangerous because ill-intentioned can exploit it to execute system code against the company server and compromise them, without any privilege or user interaction. Solanki used the jdwp-shellifier tool from Github to scan the marketing sites searching for opened port 8000.
Solanki used the jdwp-shellifier tool from Github for reconnaissance, he scanned the marketing sites and once found opened port 8000 he will establish a connection to the service without any authentication and run server-side exploit codes with root privileges.
“The tool that i used to disclose is the jdwp-shellifier. I scanned the marketing site and it had opened port 8000 (pre-auth) than i just executed after accepted connection my commands and finally disclosed a remote code execution issue.” wrote Solanki.
The opened port 8000 made him establish a connection to the service without any authentication that allowed him to execute his server-side codes with root privileges.
The expert published a video PoC for the exploitation of the flaw to demonstrate how to hack a server.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.