Paypal Patches High-severity Password Vulnerability

PayPal has confirmed that a researcher found a high-severity security vulnerability that could expose user passwords to an attacker. The researcher, Alex Birsan, earned a bug bounty of $15,300 for reporting the problem, which was disclosed January 8 having been patched by PayPal on December 11, 2019. The bug affecting what is probably one of PayPal’s most visited pages: the login form. Birsan discovered the high-severity vulnerability when he was "exploring" the main authentication flow at PayPal. His attention was drawn to the fact that a JavaScript (JS) file contained what looked like a cross-site request forgery (CSRF) token and a session ID. "Providing any kind of session data inside a valid javascript file," Birsan said, "usually allows it to be retrieved by attackers." "A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The exposed tokens were used in the POST request to solve the CAPTCHA," Paypal said, confirming Birsan's findings.