search

paypal / merchant-sdk-php

PHP SDK for integrating with PayPal's Express Checkout / MassPay / Web Payments Pro APIs
Other
231 stars 201 forks source link

I have find a Reflected XSS vulnerability in this sdk #129

Closed jgj212 closed 7 years ago

jgj212 commented 7 years ago

Hello: I have find a Reflected XSS vulnerability in this sdk.

The vulnerability exists due to insufficient filtration of user-supplied data in “token” HTTP GET parameter that will be passed to “merchant-sdk-php\samples\AccountAuthentication\GetAuthDetails.html.php”. The infected source code is line 7, there is no protection on _GET[‘token’]; if _GET[‘token’] contains evil js code, line 21 will trigger untrusted code to be excuted on the browser side.

image

So if a attacker construct a special url as follow and send it to a victim, when the victim click the url, the code which is contained in the url will be executed on the victim's browser side to do some evil. "http://localhost/php-pro/merchant-sdk-php-master/AccountAuthentication/GetAuthDetails.html.php?token=>"

The follow scrrenshot is the result to click the upper url ( win7 spq x64 + firefox 51.0.1 32bit ): image

Discoverer: ADLab of Venustech

randstraw commented 7 years ago

Thank you for submitting the issue. Would you be interested in submitting a pull request to help resolve this? If not, it is ok I will review further.

jgj212 commented 7 years ago

@pp-randy i am sorry, i am not skilled at bug fixing. You can encode the user input from the browser side, because it is not trusted .

randstraw commented 7 years ago

Adding internal tracking: BTDXCLTS-283