CVE-2017-6215: Reflected XSS in paypal/permissions-sdk-php
Summary
CVE-2017-6215: paypal/permissions-sdk-php reflected Cross-site Scripting (XSS). Affects paypal/permissions-sdk-php versions < 3.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
paypal/permissions-sdk-php is a package available on Packagist that provides functionality for handling permissions in PayPal applications. It is used to manage access tokens and permissions for PayPal API integrations. The package is vulnerable to a reflected cross-site scripting (XSS) attack in the GetAccessToken.php file, specifically in the verification_code parameter. This vulnerability allows an attacker to execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability in paypal/permissions-sdk-php arises from improper input validation in the GetAccessToken.php file. When an attacker crafts a malicious URL with a specially crafted verification_code parameter, the code is executed in the context of the user's browser. This can lead to various consequences, including session hijacking, data theft, and unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize the verification_code parameter before using it in the affected code. This can be done by using a library or function that escapes or removes any potentially malicious characters from the input. Here is an example of how the verification_code parameter can be sanitized using the htmlspecialchars function in PHP:
$verificationCode = htmlspecialchars($_GET['verification_code'], ENT_QUOTES, 'UTF-8');
This will convert any special characters to their HTML entities, preventing them from being interpreted as code.
Conclusion
The paypal/permissions-sdk-php package is vulnerable to a reflected XSS attack in the GetAccessToken.php file. This can lead to code execution in the user's browser and various security risks. To mitigate this vulnerability, it is crucial to update the package to version 3.9.2 or later. Additionally, developers should implement proper input validation and sanitization to prevent XSS vulnerabilities. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paypal/permissions-sdk-php →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of the user's browser. This can lead to various consequences, including session hijacking, data theft, and unauthorized actions on behalf of the user.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the vulnerability can be fixed by updating the paypal/permissions-sdk-php package to version 3.9.2 or later. The updated version includes proper input validation and sanitization to prevent the execution of arbitrary code.
As a temporary workaround, developers can manually sanitize the verification_code parameter before using it in the affected code. This can be done by using a library or function that escapes or removes any potentially malicious characters from the input.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
