CVE-2017-6213: Reflected XSS in paypal/invoice-sdk-php
Summary
CVE-2017-6213: paypal/invoice-sdk-php reflected XSS. Affects paypal/invoice-sdk-php versions < 3.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The paypal/invoice-sdk-php package is a PHP library that provides functionality for integrating PayPal invoicing into applications. It allows developers to generate and manage invoices using the PayPal API. The package is commonly used in e-commerce and financial applications to facilitate invoicing and payment processes. However, versions up to 3.9.0 of the package are vulnerable to a reflected cross-site scripting (XSS) attack in the samples/permissions.php file. This vulnerability can be exploited by an attacker to execute arbitrary code.
Vulnerability Detail
The vulnerability in paypal/invoice-sdk-php arises from a lack of proper input sanitization in the samples/permissions.php file. Specifically, the permToken parameter is not properly validated or sanitized before being included in the HTML output. This allows an attacker to craft a malicious URL that, when clicked by a victim, will execute arbitrary JavaScript code in the context of the victim's browser. This can lead to various consequences, including session hijacking, data theft, or the injection of malicious content into the application. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the permToken parameter in the samples/permissions.php file before including it in the HTML output. This can be done by using a suitable sanitization function, such as htmlspecialchars(), to escape any special characters that could be interpreted as HTML or JavaScript code. Here is an example of how the code can be modified:
$permToken = htmlspecialchars($_GET['permToken'], ENT_QUOTES, 'UTF-8');
Conclusion
The paypal/invoice-sdk-php package up to version 3.9.0 is vulnerable to a reflected XSS attack in the samples/permissions.php file. This can be exploited by an attacker to execute arbitrary code in the context of a victim's browser. To mitigate this vulnerability, developers should update to version 3.9.1 or later, which includes proper input validation and sanitization. In the meantime, a temporary workaround is available by manually sanitizing the permToken parameter. For further support, contact DevNack.com.
See every vulnerability recorded for paypal/invoice-sdk-php →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to various consequences, including session hijacking, data theft, or the injection of malicious content into the application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it to identify any vulnerable dependencies.
Yes, the vulnerability can be fixed by updating the paypal/invoice-sdk-php package to version 3.9.1 or later. The updated version includes proper input validation and sanitization to prevent the execution of arbitrary code.
Yes, as a temporary workaround, developers can manually sanitize the permToken parameter in the samples/permissions.php file before including it in the HTML output. This can be done by using a suitable sanitization function, such as htmlspecialchars(), to escape any special characters that could be interpreted as HTML or JavaScript code.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your application.
