Dear Readers, today I want to share my story on how I want to buy my new Laptop (MacBook Pro would be cool) so the notebook costs round about 1700$ with the help of BugBounty Money I want to buy it $$$.
Background#
So what I’ve done first is to look at a list of bug bounties, and the one I chose PayPal. After visiting their Page (https://www.paypal.com/us/webapps/mpp/security-tools/reporting-security-issues) I saw some interesting things.
The following domains are included for the paypal.com family of companies:
- PayPal.com
- Zong
- BillMeLater
- Where
- Card.io
- Billsafe
Default credentials on dev.zong.com#
So Zong is in Scope for the Bug bounty, I did a quick reverse DNS Lookup on Zong and found out that they have a domain called dev.zong.com, with a port 8080 open. After some research I found out that there was a Tomcat service running, when it asked me for the credentials I tried what everyone else would try … admin:admin and guess what ? It was successful.
1. Apache Tomcat Manager Common Administrative Credentials (http: dev.zong.com)
So my first Vulnerability, so proud!
After a couple of hours I got the Answer from PayPal : Duplicate = 0$ for me.
So a little bit disappointed but I want to go on further.
Stored XSS in PayPal invoices#
So my journey went on… I wanted to have a closer look on PayPal. PayPal has the option of sending invoices to customers, with the ability to also add Products, what I quickly found out was that the Description field of the Products is vulnerable to XSS with the following payload “#“>”. And I was like Fuck yes! Stored Cross Site Scripting on the main site of PayPal!
So, how to go further? The Vulnerability has to be an impact on other customers of PayPal too. So I created another PayPal account and sent the invoice to it. And guess what ? The XSS got executed.
Okay heading over to the Bug Bounty form and filled out my second report :
2. Paypal invoice stored XSS
Here you can see a working demo
So my second Vulnerability worth 750$ if valid…would be half of the Laptop… After about one day PayPal updated my case and this time… ? Duplicate = 0$ for me.
Reflected XSS on financing.paypal.com#
Okay at this point I was a bit more disappointed but still I don’t want to give up! This time I wanted to go a bit deeper into the PayPal subdomains, as I did this I found a domain called financing.paypal.com. This domain allowed a user to generate ads for their PayPal site, as I looked at the URL I saw that the Parameter ?120×90 was reflected to the Page, then I tried to inject some XSS and it got executed
Awwwyyyeeaaaahhh and again I filled another Bug Form for PayPal with super description etc:
3. financing.paypal.com reflected XSS
Here you can see a working PoC
After about three days I got an answer from PayPal : Duplicate = 0$ for me
So… after 3 Vulnerabilities… still at 0$ not bad but I am still feeling it
Stored XSS on apps.paypal.com#
After some crying, I started again to look at the subdomains of PayPal what I found this time was a domain called apps.paypal.com, logging in there allowed me to create a new app, to this app I could add files, with the restriction of some file types but anyways. I tried to include some malformed images with XSS payloads in them, and they got executed.
Cool yet another Cross Site Scripting… so I filled in another Bug Bounty form.
4. Four stored XSS at apps.paypal.com
The answer came in pretty quick, they answered me that this issue does not affect any PayPal users, they were right… 0$ for me.
Admin access on paypal-communities.com#
So … okay let’s go on further as they write on their blog also domains including paypal-__.com are in scope i went on searching for them. The first one I found was the paypal-communities Page. After some URL Manipulation, Cross Site Scripting, Cookie Playing I was finally able to log into the Administrator Panel of the Community board without any limitations. At this point I wasn’t even realizing that I am the Admin of this board at this Point.
Really at this point I had no clue what was going on… Later on the panel I found a box for a “Welcome Message” for the users. I tried my XSS stuff and it got executed (of course I am the f*cking admin right now) but I still wasn’t aware of this fact.
So I filled in the Form
5. stored Cross Site Scripting on paypal-communities.com
Okay then I pressed send and went back to the board, then suddenly, I realized that there are some strange things going on here, I can do some changes to user groups, there is a Group called “Admin” “Paypal” “Users” I can delete them… may I be admin? Yes I was admin… So I was like
Okay, filled in another form again!
5.5 Privilege Escalation on Paypal-Communities.com (Admin)
After sending the message, my Burp session got killed, I exited without saving my results. After half an hour a reply from PayPal came in, they need more information on this, a way on how to reproduce the whole thing, then I tried to go back on the page to see if it still works, but nope “Module not found” they already fixed the bug.
0$ for me.
Reflected XSS on paypal-marketing.com#
After banging my head 20 times against the wall I went on with my search. This time I searched on paypal-marketing.com, on this page there was a search form for finding PayPal partners near you, after some time I found out that the search form was vulnerable to reflected XSS
https://www.paypal-marketing.com/paypal/html/hosted/emarketing/partner/directory/#z=%23%E2%80%9C%3E%3Cimg+src%3D/+onerror%3Dalert%281%29%3E&r=DEU
Sending this URL to a PayPal user, I could steal the cookie.
So filled in yet another form :
6. paypal-marketing.com XSS in the Search field (ZIP or Postal Code)
After a few days, I got the same ol’ answer from PayPal
Hi Patrik,
Thanks for contacting us. While your submission is a duplicate as it was discovered by another researcher it is currently scheduled to be fixed.
So still 0$ for me.
Cookie injection on apps.paypal.com#
So this time I thought I have to be more creative. So I went back to apps.paypal.com and saw that they have a tool to check the spelling of what someone is writing. Digging deeper I found out that this tool is doing an API call to another Domain, within this call the user is able to set a name for the Dictionary used, the Dictionary name is Vulnerable to stored XSS.
After recognizing this, I wondered how to exploit this particular issue, I had the following idea, I copied the API call to the third Party Application, then I shortened the link with bit.ly and then I sent the link to a user. When the User clicks on this link, a cookie with the XSS is stored now on the Victim’s Computer waiting to be executed.
The fun part of this Cookie is that it expires on Friday Jan 1 2038, so if a user clicks on the Dictionary option one time in 14 years the XSS gets executed. A scenario a bit weird, but it works. If you want to see a working demo, see here: https://www.youtube.com/watch?v=aPYRqXakyB8
So I tried my best, filling in the next report:
7. Cookie Injection stored XSS on apps.paypal.com
The response was quite disappointing, the report was marked as invalid due to the fact that there is too much user input required….
So … here we go again 0$ for me.
Takeaways#
So after 7 Bugs, my resumee 5 of them were duplicates and 2 of them were invalid, I have to be honest to myself, I suck at bug bounty, but how to pay the new MacBook ?
Sums it up.
