PayPal fixed a flaw that allowed attackers to deliver malicious images

PayPal has fixed a vulnerability that could have been exploited by attackers to deliver malicious images through the payment pages of the website.

The Security researcher Aditya K Sood discovered a vulnerability that could have been exploited by attackers to deliver malicious image through the payment pages of the PayPal website.

The expert noticed that the URL of payment pages set up by PayPal users included a parameter called “image_url,” then he tried to manipulate it. Sood discovered that it was possible to assign to the value of the parameter a URL pointing to an image hosted on a remote server.

This behavior could have been exploited by attackers to use a third-party vendor’s PayPal payment page to deliver malicious images.

The experts demonstrated the security flaw by delivering an image on a vendor’s payment page, obviously, the attacker could have delivered a malware or an exploit hidden in the image.

“This is an insecure design as PayPal allows remote users to inject images owned by them into the PayPal components used for transactions by the customers,” Sood explained to SecurityWeek. “That being said, the question is — can you deliver malware or an exploit through images? The answer is yes. Exploit techniques such as Stegosploit can be used to achieve that.”

The attack scenario is simple, the attacker needs to trick an unauthenticated user to click on a specially crafted link. The victims will see a URL belonging to PayPal.com, so he will likely trust the link clicking on it.

PayPal told to Sood that the attack scenario he hypothesized it unlikely because an attacker could use different methods to serve a malware. PayPal experts also added that the payment processor actively scan for malicious content.

 

The vulnerability was reported to PayPal in January, but the IT giant fixed it only this month, Sood was rewarded with $1,000 for his discovery.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – PayPal, hacking)