PayPal has confirmed that a researcher found a high-severity security vulnerability that could expose user passwords to an attacker.

The researcher, Alex Birsan, earned a bug bounty of $15,300 for reporting the problem, which was disclosed January 8 having been patched by PayPal on December 11, 2019.

The bug affecting what is probably one of PayPal’s most visited pages: the login form.

Birsan discovered the high-severity vulnerability when he was "exploring" the main authentication flow at PayPal. His attention was drawn to the fact that a JavaScript (JS) file contained what looked like a cross-site request forgery (CSRF) token and a session ID. "Providing any kind of session data inside a valid javascript file," Birsan said, "usually allows it to be retrieved by attackers."

"A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The exposed tokens were used in the POST request to solve the CAPTCHA," Paypal said, confirming Birsan's findings.

"The researcher identified a method by which a user, starting from a malicious site, could expose the security challenge token to a third party via a cross-site script inclusion (XSSI) attack. If the user then followed a login link from the malicious site and entered their credentials, the malicious third party could complete the security challenge, triggering the authentication request replay and exposing the user's password. This exposure only occurred if a user followed a login link from a malicious site, similar to a phishing page."

The proof of concept, along with all relevant information, was submitted to PayPal’s bug bounty program on the 18th of November 2019, and was validated by HackerOne 18 days later.

A patch was applied around 24 hours later, meaning that the bug was fixed only five days after PayPal became aware of it — quite an impressive turnaround time.

PayPal said it implemented additional controls on the security challenge request to prevent token reuse, which resolved the issue, and that "no evidence of abuse was found."