Dear followers,
i recently discovered a stored cross site scripting vulnerability on Paypal’s core site. The scenario is a bit weird, but i hope to explain everything as good as possible.
During my testings i often create accounts with malicious Javascript contet as the Name, Organization etc etc. While testing on Paypal i did the same, i tried to make an account with the username.
"><img src=x onerror javascript=alert(1337)">.jpg
But when i tried to fullfill the registration the security module of Paypal showed me an error that there is some kind problem with my request. When i looked at the URL i saw that there was some kind of progress bar
https://www.paypal.com/webapps/merchantboarding/webflow/unifiedflow?execution=e1s1
What came first in my mind , it’s the same url you get once logged in into a legimitate accout, so i tried to erease everything after the /webapps/ url, and suddenly i was into my new Paypal account with the malicious Javascript content. I went to the profile settings page and saw that 3 of my javascript snippets were executed. So far so good. Some of you might know that you need a szenario in which users of Paypal could be exploited in order to recieve a bug bounty. So i thought about where i could inject this to other Paypal users. A few months ago i found also a stored cross site scripting issue within a invoice created by paypal. If you look at the landing page of paypal you will see that every invoice you recieve will include the name of the user that send it to you. So, my Username is malicious Javascript, and Paypal allows me to send invoices to every single Paypal user by just knowing their E-Mail. So i went further and created an invoice, and sent it to my second Paypal accout. I logged in to the second one, and the Javascript Prompt appears on my screen.
To summarize the progress :
1. Create an account with the malicious Payload
2. At the point where the Paypal systems stops you from continuing erease the URL till /webapps/ (bypassed the Security restriction)
3. Create an invoice, send it to the victim
4. Victim logs into the the Account and the Payload gets executed
I did a small POC Video which describes the impact :
I hope you enjoyed 🙂
English 
German