Tuesday, 30 July 2019

Paypal bug $10K - All Secondary users account takeover leads to unauthorized money transfer from paypal business accounts

In the name of Allah the beneficient the most merciful.

It's been quite long time i wrote a blog due to some commitments , Today i would like to disclose one of my findings in Paypal which was reported via Hackerone.

This bug allowed me to takeover all secondary accounts of any paypal business account , there was an IDOR bug which gave me control over any secondary user account i want.

Paypal business accounts are used by millions of organizations worldwide and business owners
assign various privileges to secondary user accounts so as to ease their task. One of the privilege business owners give to secondary user is transfer money from paypal business account to any other account they like .  So, i used this particular privilege in describing the issue which if exploited it would have given attacker unauthorized access to transfer money from any paypal business account by taking over secondary account of users having privilege as "Transfer money".

Steps:
Two different business accounts were needed for POC.

-> From victim@gmail.com business account i created secondary user
having username as victim1234

-> From attacker@gmail.com business account i created secondary user
having username as attacker1234

-> From attacker account after going to secondary user account
  here https://www.paypal.com/businessmanage/users/1660971175791245038
( this id is for attacker1234 , from attacker@gmail.com ) and then captured the request
to edit the permission like this


PUT /businessmanage/users/api/v1/users? HTTP/1.1
Host: www.paypal.com
Connection: close

[{"id":"1660971175791245038","accessPoint":{"privileges":["MANUAL_REFERENCE_TXN","VIEW_CUSTOMERS","SEND_MONEY"],"id":"4446113495","accounts":["attacker@gmail.com"]},"roleID":0,"roleName":"CUSTOM","privilegeChanged":true,"privilegeSecondaryName":"ttt ttts"}]

->  Now in the above PUT request the first id "it can be anything" i entered
id:"asdfjdsf"( some dummy value)  and in the  second id:446113495 , is the actual id of each secondary user which was vulnerable to IDOR.

->  This second id is incremental and enumerable as it's only numbers.
If attacker would have changed it to 44613496(lets suppose it is id of victim1234 ) then the associated secondary user account i.e., victim1234 would have been listed to him in https://www.paypal.com/businessmanage/users .

-> This way if attacker would have just enumerated from 44613495 to 44613999 then all these secondary accounts would have been showed to him in Manage users section of attackers business account , then attacker  just needed to change the password of user via Manage users section and Game over!!
Complete takeover of any secondary account.

-> After this attacker could have login to any secondary user account having privilege as "Transfer Money" and then it would have allowed him transfer money from victim account to attacker own account .


Now Paypal remediated the issue and found no evidence of any kind of abuse associated with it.


Summary by Paypal in hackerone about the issue.





Thanks for reading.

Hope you enjoyed reading it.


Regards
Mohd Haji
https://www.linkedin.com/in/mohd-haji-490960a0/

13 comments:

  1. I got my already programmed and blanked ATM card to withdraw the maximum of $5,500 daily for a maximum of 6 years. I am so happy about this because i got mine last week and I have used it to get more then $350,000 and ready to pay more. Joyce Nora Hackers is giving out the card just to help the poor and needy though it is illegal but it is something nice and she is not like other scam pretending to have the blank ATM cards And no one gets caught when using the card get yours from Joyce Nora today! Just send an
    WhatsApp Her: +1(561)768-4422 Email
    [joyceatmcard7@gmail.com]

    ReplyDelete
    Replies
    1. Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number

      Delete
    2. Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number

      Delete

      Delete
    3. Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number 7047602749 7047309283.....
      Pay pal Customer Care Number

      Delete

      Delete
    4. GET RICH WITH BLANK ATM CARD ... Whatsapp: +18033921735

      I want to testify about Dark Web blank atm cards which can withdraw money from any atm machines around the world. I was very poor before and have no job. I saw so many testimony about how Dark Web hackers send them the atm blank card and use it to collect money in any atm machine and become rich. I email them also and they sent me the blank atm card. I have use it to get 90,000 dollars. withdraw the maximum of 5,000 USD daily. Dark Web is giving out the card just to help the poor. Hack and take money directly from any atm machine vault with the use of atm programmed card which runs in automatic mode.

      Email: darkwebblankatmcard@gmail.com
      Text & Call or WhatsApp: +18033921735

      Delete
  2. Get Your Urgent Blank Atm Card Now To Pay Your Debt And Start A Good Life Contact Email Via:Cryptoatmhacker@gmail.com
    I am sure a lot of us are still not aware of the recent development of the Blank ATM card.. An ATM card that can change your financial status within few days. With this Blank ATM card, you can withdraw between $2,000-$3,000 -$5, 500-$8,800-$12, 000-$20,000-$35,000 -$50,000 daily from any ATM machine in the world. There is no risk of getting caught by any form of security if you followed the instructions properly. The Blank ATM card is also sophisticated due to the fact that the card has its own security making your transaction very safe and untraceable. i am not a stupid man that i will come out to the public and start saying what someone have not done. For more info contact Mr john and also on how you are going to get your Card, Order yours today via Email: cryptoatmhacker@gmail.com
    Contact Via web site.. https://cryptoatmhacker1.yolasite.com/

    ReplyDelete
  3. HELLO do you need a hacking services? Are you faced with delays and unnecessary excuses from fake hackers on your jobs?.
    THEN CONTACT= TALENTEDINTERNETHACKERS@GMAIL.COM
    WHATSAPP = +447723540482    Worry no more for we are the best hackers alive. What hacking service do you need? We can render it with swift response and no delay, your job is 100% guaranteed.  Our services includes the followings and more.
    " University grades changing
    " WhatsApp Hack
    " Bank accounts hack
    " Twitters hack"DUIS HACK
     " Email accounts hack
    " Website crashed hack
    " Server crashed hack
    " Sales of Spyware and Keylogger software
    " Retrieval of lost file/documents
    " Erase criminal records hack
    " Databases hack
    " Sales of Dumps cards of all kinds
    " Untraceable IP
    " Individual Computers Hack
    " Money Transfer (western union, money gram,ria etc)
    " Bank account hack and Crediting etc.
    our services are the best online.
    Contact us at=TALENTEDINTERNETHACKERS@GMAIL.COM
    WHATSAPP =  +447723540482   
    PROBLEM SHEAR IS PROBLEM SOLVE

    ReplyDelete
  4. HELLO do you need a hacking services? Are you faced with delays and unnecessary excuses from fake hackers on your jobs?.
    THEN CONTACT= TALENTEDINTERNETHACKERS@GMAIL.COM
    WHATSAPP = +447723540482    Worry no more for we are the best hackers alive. What hacking service do you need? We can render it with swift response and no delay, your job is 100% guaranteed.  Our services includes the followings and more.
    " University grades changing
    " WhatsApp Hack
    " Bank accounts hack
    " Twitters hack"DUIS HACK
     " Email accounts hack
    " Website crashed hack
    " Server crashed hack
    " Sales of Spyware and Keylogger software
    " Retrieval of lost file/documents
    " Erase criminal records hack
    " Databases hack
    " Sales of Dumps cards of all kinds
    " Untraceable IP
    " Individual Computers Hack
    " Money Transfer (western union, money gram,ria etc)
    " Bank account hack and Crediting etc.
    our services are the best online.
    Contact us at=TALENTEDINTERNETHACKERS@GMAIL.COM
    WHATSAPP =  +447723540482   
    PROBLEM SHEAR IS PROBLEM SOLVE

    ReplyDelete
  5. I got my already programmed and blanked ATM card to withdraw the maximum of $5,500 daily for a maximum of 6 years. I am so happy about this because i got mine last week and I have used it to get more then $350,000 and ready to pay more. Joyce Nora Hackers is giving out the card just to help the poor and needy though it is illegal but it is something nice and she is not like other scam pretending to have the blank ATM cards And no one gets caught when using the card get yours from Joyce Nora today! Just send an
    WhatsApp Her: +1(561)768-4422 Email
    [joyceatmcard7@gmail.com]

    ReplyDelete

  6. Finally got my debts of my neck and i have enough money saved for my Christmas shopping. It all happened as i stumbled into this email address blankatm002@gmail.com initially i was looking to get extra jobs to boost my salary and i found how the blank ATM card from this company gives you more than $20,000 all in 1 month. At first i though it was another internet scheme until i saw several reviews of how this blank card from this company has changed the lives of many without hesitation i ordered for the card and in less than 7 days it was delivered to me and the agent showed me how it works and it was even tested its been just 3 weeks and everything seems a lot less stressful this company has really changed my life and standard of living. I would love you on this site to visit blankatm002@gmail.com and get a card today to ease that stress and get good money its so quick.

    ReplyDelete
  7. Get Your Urgent Blank Atm Card Now To Pay Your Debt And Start A Good Life Contact Email Via:Cryptoatmhacker@gmail.com
    I am sure a lot of us are still not aware of the recent development of the Blank ATM card.. An ATM card that can change your financial status within few days. With this Blank ATM card, you can withdraw between $2,000-$3,000 -$5, 500-$8,800-$12, 000-$20,000-$35,000 -$50,000 daily from any ATM machine in the world. There is no risk of getting caught by any form of security if you followed the instructions properly. The Blank ATM card is also sophisticated due to the fact that the card has its own security making your transaction very safe and untraceable. i am not a stupid man that i will come out to the public and start saying what someone have not done. For more info contact Mr john and also on how you are going to get your Card, Order yours today via Email: cryptoatmhacker@gmail.com
    Contact Via web site.. https://cryptoatmhacker1.yolasite.com/

    ReplyDelete
  8. My ex ruined my credit due to his incessant extravagant spending spree, I found myself in a big mess. I talked to a credit repair company and I was told that it would take me non less than a year to fix my credit. I was devastated, that's a very long time which I can't cope with. I looked online and came across Credit Doctor's contact, hit him up and to my greatest surprise, my credit was repaired in 4 working days from 486 -810. I was so amazed and it didn't cost me too much really. I implore you to contact him on for all credit issues and hacking issues. No doubt that he's the best out there and your problems will be solved!
    HACKINTECHNOLOGY@GMAIL.COM
    +16692252253

    ReplyDelete
  9. Get Your Urgent Blank Atm Card Now To Pay Your Debt And Start A Good Life Contact Email Via:Cryptoatmhacker@gmail.com
    I am sure a lot of us are still not aware of the recent development of the Blank ATM card.. An ATM card that can change your financial status within few days. With this Blank ATM card, you can withdraw between $2,000-$3,000 -$5, 500-$8,800-$12, 000-$20,000-$35,000 -$50,000 daily from any ATM machine in the world. There is no risk of getting caught by any form of security if you followed the instructions properly. The Blank ATM card is also sophisticated due to the fact that the card has its own security making your transaction very safe and untraceable. i am not a stupid man that i will come out to the public and start saying what someone have not done. For more info contact Mr john and also on how you are going to get your Card, Order yours today via Email: cryptoatmhacker@gmail.com
    Contact Via web site.. https://cryptoatmhacker1.yolasite.com/

    ReplyDelete