How to Hack PayPal Account Using CSRF
1- Reusable CSRF Token:
The CSRF token “that authenticate every
single request made by the user” which can be also found in the request
body of every request with the parameter name “Auth” get changed with
every request made by user for security measures, but after a deep
investigation I found out that the CSRF Auth is Reusable for that
specific user email address or username, this means If an attacker found
any of these CSRF Tokens, He can then make actions in the behave of any
logged in user.
Hmm, it seems interesting but still not
exploitable, as there is no way for an attacker to get the “Auth” value
from a victim session.
2- Bypassing the CSRF Auth System:
The CSRF Auth verifies every single
request of that user, So what If an attacker “not logged in” tries to
make a “send money” request then PayPal will ask the attacker to provide
his email and password, The attacker will provide the “Victim Email”
and ANY password, Then he will capture the request, The request will
contain a Valid CSRF Auth token Which is Reusable and Can authorise this
specific user requests. Upon Further Investigation, We have found out
that an Attacker can obtain the CSRF Auth which can be valid for ALL
users, by intercepting the POST request from a page that provide an Auth
Token before the Logging-in process, check this page for the magical
CSRF Auth “https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”. At
this point the attacker Can CSRF “almost” any request on behave of this
user.
The application generates a valid “Auth” token for a logged-out user!
Through examination of the password
change process, he found that an attacker can NOT Change the victim
password without answering the Security Questions set by user, Also the
user himself can NOT change the security questions without entering the
password!
3- ByPassing the Security Questions Change:
The initial process of “setting” security questions is not password protected and is reusable
After further investigation, noticed
that the request of setting up the security questions “which is
initiated by the user while signing up” is not password-protected, and
it can be reused to reset the security questions up without providing
the password, hence, Armed with the CSRF Auth, an attacker can CSRF this
process too and change the victim’s Security questions.
At this point, An attacker can conduct a
targeted CSRF attack against a PayPal users and take a full control
over his account Hence, An attacker can CSRF all the requests including
but not limited to:
1- Add/Remove/Confirm Email address
2-Add fully privileged users to business account
3- Change Security questions
4- Change Billing/Shipping Address
5- Change Payment methods
6- Change user settings(Notifications/Mobile settings) ………… and more.
To automate the who process, Yasser has
coded a Python interactive server to demonstrate how an attacker can
exploit this vulnerability in a real-life scenario attack.
.jpg)
