Security researcher Milan A Solanki discovered a new critical remote code execution vulnerability in PayPal platform. An attacker could exploit the vulnerability to execute arbitrary code on the PayPal Marketing online-service web-application server, the flaw has been rated Critical by Vulnerability Lab with a CVSS count of 9.3.
Solanki reported the flaw to the Paypal developer team that promptly fixed it.
The Remote Code Execution flaw affects the Java Debug Wire Protocol (JDWP) protocol of the PayPal marketing online service web-server, as explained by Oracle this optional protocol it used for communication between a debugger and the Java virtual machine (VM) which it debugs.
One year ago security researcher at IOActive Christophe Alladoum published an interesting post titled “Hacking the Java Debug Wire Protocol – or – “How I met your Java debugger”. The JDWP does not implement any authentication mechanism, this allows an attacker to execute arbitrary code remotely onto the affected Web server.
The vulnerability in PayPal platform is very dangerous because ill-intentioned can exploit it to execute system code against the company server and compromise them, without any privilege or user interaction. Solanki used the jdwp-shellifier tool from Github to scan the marketing sites searching for opened port 8000.
Solanki used the jdwp-shellifier tool from Github for reconnaissance, he scanned the marketing sites and once found opened port 8000 he will establish a connection to the service without any authentication and run server-side exploit codes with root privileges.
“The tool that i used to disclose is the jdwp-shellifier. I scanned the marketing site and it had opened port 8000 (pre-auth) than i just executed after accepted connection my commands and finally disclosed a remote code execution issue.” wrote Solanki.
The opened port 8000 made him establish a connection to the service without any authentication that allowed him to execute his server-side codes with root privileges.
The expert published a video PoC for the exploitation of the flaw to demonstrate how to hack a server.
(Security Affairs – PayPal, Remote Code Execution)
CISA ordered U.S. federal agencies to improve management of edge network devices and replace unsupported…
AISURU/Kimwolf botnet hit a record 31.4 Tbps DDoS attack lasting 35 seconds in Nov 2025,…
A study found nearly 5 million servers exposing Git metadata, with 250,000 leaking deployment credentials…
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SmarterTools SmarterMail and React Native Community CLI…
Substack confirmed a data breach after a hacker leaked data from nearly 700,000 users, including…
Italy stopped Russian-linked cyberattacks targeting Foreign Ministry offices and Winter Olympics websites and hotels, Foreign…
This website uses cookies.
