PayPal has fixed a vulnerability that could have been exploited by attackers to deliver malicious images through the payment pages of the website.
The Security researcher Aditya K Sood discovered a vulnerability that could have been exploited by attackers to deliver malicious image through the payment pages of the PayPal website.
The expert noticed that the URL of payment pages set up by PayPal users included a parameter called “image_url,” then he tried to manipulate it. Sood discovered that it was possible to assign to the value of the parameter a URL pointing to an image hosted on a remote server.
This behavior could have been exploited by attackers to use a third-party vendor’s PayPal payment page to deliver malicious images.
The experts demonstrated the security flaw by delivering an image on a vendor’s payment page, obviously, the attacker could have delivered a malware or an exploit hidden in the image.
“This is an insecure design as PayPal allows remote users to inject images owned by them into the PayPal components used for transactions by the customers,” Sood explained to SecurityWeek. “That being said, the question is — can you deliver malware or an exploit through images? The answer is yes. Exploit techniques such as Stegosploit can be used to achieve that.”
The attack scenario is simple, the attacker needs to trick an unauthenticated user to click on a specially crafted link. The victims will see a URL belonging to PayPal.com, so he will likely trust the link clicking on it.
PayPal told to Sood that the attack scenario he hypothesized it unlikely because an attacker could use different methods to serve a malware. PayPal experts also added that the payment processor actively scan for malicious content.
The vulnerability was reported to PayPal in January, but the IT giant fixed it only this month, Sood was rewarded with $1,000 for his discovery.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.