Researcher Earns $10,000 For Reporting PayPal Account Hijacking Bug

By Eduard Kovacs on December 04, 2014
 
Egyptian researcher Yasser Ali has found a way to bypass the cross-site request forgery (CSRF) protection mechanisms implemented by PayPal and take complete control of a user's account.
The expert identified the vulnerability after analyzing the CSRF authentication tokens used when a PayPal customer makes a request to the website. For security measures, these tokens, which are included in the "Auth" parameter, are changed with every request. However, Ali discovered that the tokens were reusable for that specific email address or username.
The expert discovered that an attacker could obtain tokens that were valid for all users by accessing PayPal's "Send Money" page. On this page, customers enter their email address, the recipient's email address and the amount of money they want to send. Then, they are prompted to enter their email address/username and password to complete the process. However, Ali found that only the email address needed to be valid for the page to provide a valid token, which could be obtained by intercepting the POST request.
 
full article