New Unpatched Bug Could Let Attackers Steal Money from PayPal Users

A security researcher claims to have uncovered an unpatched vulnerability in PayPal’s money transfer service that could permit attackers to trick victims into unknowingly completing attacker-directed transactions with a single simply click.

Clickjacking, also called UI redressing, refers to a technique whereby an unwitting person is tricked into clicking seemingly innocuous webpage components like buttons with the purpose of downloading malware, redirecting to destructive internet sites, or disclose sensitive info.

This is typically reached by exhibiting an invisible webpage or HTML component on top of the obvious web site, resulting in a circumstance the place customers are fooled into contemplating that they are clicking the reputable webpage when they are in fact clicking the rogue aspect overlaid atop it.

“Consequently, the attacker is ‘hijacking’ clicks intended for [the legitimate] website page and routing them to yet another site, most probable owned by one more software, area, or the two,” security researcher h4x0r_dz wrote in a publish documenting the conclusions.

h4x0r_dz, who learned the issue on the “www.paypal[.]com/agreements/approve” endpoint, claimed the issue was noted to the firm in October 2021.

“This endpoint is built for Billing Agreements and it should settle for only billingAgreementToken,” the researcher described. “But throughout my deep screening, I identified that we can move another token type, and this sales opportunities to stealing money from [a] victim’s PayPal account.”

This signifies that an adversary could embed the aforementioned endpoint inside of an iframe, causing a target previously logged in a web browser to transfer funds to an attacker-controlled PayPal account basically on the click on of a button.

Even a lot more concerningly, the attack could have experienced disastrous penalties in on the web portals that integrate with PayPal for checkouts, enabling the malicious actor to deduct arbitrary amounts from users’ PayPal accounts.

“There are on the web services that enable you insert harmony employing PayPal to your account,” h4x0r_dz claimed. “I can use the exact same exploit and pressure the person to add revenue to my account, or I can exploit this bug and let the target develop/shell out Netflix account for me!”

(Update: The tale has been rectified to point out that the bug is nevertheless unpatched and that the security researcher was not awarded any bug bounty for reporting the issue. The mistake is regretted. We have also achieved out to PayPal for extra aspects.)

Observed this short article interesting? Abide by THN on Facebook, Twitter  and LinkedIn to browse a lot more exceptional content material we put up.

Some parts of this article are sourced from:
thehackernews.com