Unpatched Bug Could Let Attackers Steal Money from PayPal Users


Level 37
Thread author
Top poster
Feb 4, 2016
A security researcher claims to have discovered an unpatched vulnerability in PayPal's money transfer service that could allow attackers to trick victims into unknowingly completing attacker-directed transactions with a single click.

Clickjacking, also called UI redressing, refers to a technique wherein an unwitting user is tricked into clicking seemingly innocuous webpage elements like buttons with the goal of downloading malware, redirecting to malicious websites, or disclose sensitive information.

This is typically achieved by displaying an invisible page or HTML element on top of the visible page, resulting in a scenario where users are fooled into thinking that they are clicking the legitimate page when they are in fact clicking the rogue element overlaid atop it.

"Thus, the attacker is 'hijacking' clicks meant for [the legitimate] page and routing them to another page, most likely owned by another application, domain, or both," security researcher h4x0r_dz wrote in a post documenting the findings.

h4x0r_dz, who discovered the issue on the "www.paypal[.]com/agreements/approve" endpoint, said the issue was reported to the company in October 2021.

"This endpoint is designed for Billing Agreements and it should accept only billingAgreementToken," the researcher explained. "But during my deep testing, I found that we can pass another token type, and this leads to stealing money from [a] victim's PayPal account."