CVE-2017-6217: Reflected XSS in paypal/adaptivepayments-sdk-php
Summary
CVE-2017-6217: paypal/adaptivepayments-sdk-php vulnerable to a reflected XSS. Affects paypal/adaptivepayments-sdk-php versions < 3.9.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The paypal/adaptivepayments-sdk-php package is a PHP SDK provided by PayPal for integrating Adaptive Payments functionality into PHP applications. It allows developers to easily interact with PayPal's Adaptive Payments API to process payments, set payment options, and perform other related tasks.
Vulnerability Detail
The package version 3.9.2 of paypal/adaptivepayments-sdk-php is vulnerable to a reflected cross-site scripting (XSS) attack in the SetPaymentOptions.php file. This vulnerability allows an attacker to inject malicious code into the application, which is then executed in the context of the victim's browser. The impact of this vulnerability can range from unauthorized access to sensitive information to complete compromise of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can sanitize user input before using it in the affected code. This can be done by using appropriate input validation and output encoding techniques. For example, in the SetPaymentOptions.php file, any user-supplied input should be properly validated and encoded before being included in the response HTML.
Conclusion
In conclusion, the paypal/adaptivepayments-sdk-php package version 3.9.2 is vulnerable to a reflected XSS attack in the SetPaymentOptions.php file. It is recommended to upgrade to a non-vulnerable version of the package and sanitize user input as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for paypal/adaptivepayments-sdk-php →
FAQ
This vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially leading to unauthorized access to sensitive information or complete compromise of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your composer.lock file and Vulert will analyze it to identify any vulnerable packages.
Yes, a fix is available for this vulnerability. Developers should upgrade to a non-vulnerable version of the paypal/adaptivepayments-sdk-php package by updating their composer.json file and running the composer update command.
Yes, a temporary workaround is to sanitize user input before using it in the affected code. This can be done by implementing proper input validation and output encoding techniques.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database). Search for the advisory with the ID GHSA-9r4x-3534-w3f9.
