One of my findings on PayPal.com. When creating an invoice, PayPal lets users upload attachments, and one of the allowed attachment types is an XML file. What the developers appear to have missed is that you can embed HTML inside an XML file: the xmlns namespace declaration lets you pull in XHTML, so a valid file looks something like this:
<html>
<head></head>
<body>
<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert(1)</something:script>
</body>
</html>Proof of concept#
When I uploaded a file with this content and a .xml extension, the interpreter on PayPal’s side executed the payload — in this case alert(1). To meet the requirements for a bounty you always have to show that such a vulnerability is exploitable and therefore a real risk to other PayPal users. In this case it was pretty easy, you could either send the link to the file directly (it does not matter whether the victim is logged in or not) or attach it to an invoice and wait for the recipient to click it.
