After an independent security researcher warned PayPal how its server could be hacked by exploiting a critical remote code execution vulnerability in the server's Java Debug Wire Protocol, it only took PayPal four days to patch the flaw with a CVSS count of 9.3. It only took PayPal four days to patch a critical remote code execution vulnerability with a Common Vulnerability Scoring System (CVSS) count of 9.3. The flaw, in the Java Debug Wire Protocol (JDWP) in PayPal’s marketing online service web-server, allowed “remote attackers to execute system specific code against a target system to compromise the webserver.”JDWP, a component of the Java Platform Debugger Architecture, is the “protocol used for communication between a debugger and the Java virtual machine (VM) which it debugs,” explained independent security researcher Milan A. Solanki. “JDWP does not use any authentication and could be abused by an attacker to execute arbitrary code on the affected server.”Hacking JDWP was previously covered by IOActive, which also has jdwp-shellifier – an exploitation script – on GitHub. Researcher Christophe Alladoum looked at “JDWP from a pentester/attacker perspective,” explaining that it uses neither authentication nor encryption, and how “when such a service is exposed to a hostile network, or is Internet facing, things could go wrong.” He added, “Not only does JDWP allow you to access and invoke objects already residing in memory, it also allows you to create or overwrite data.”Alladoum explained, “When faced with an open JDWP service, arbitrary command execution is exactly five steps away (or with this exploit, only one command line away).” In other words, “open JDWP service means reliable RCE” (remote code execution). Solanki used the jdwp-shellifier tool. After scanning PayPal’s marketing site, he opened port 8000; he was able to establish a connection without any authentication and execute server-side codes with root privileges.Solanki provided a proof-of-concept video showing how the “remote code execution web vulnerability can be exploited by remote attackers without privileged application user account or user interaction.” For security demonstration or to reproduce the security vulnerability follow the provided information and steps below to continue.Manual steps to reproduce the security vulnerability …1. Scan the site with the jdwp-shellifier tool.2. Open port 8000 and connect to the service without auth.3. Execute own server-side commands as root user.4. Successful reproduce of the vulnerability!He notified PayPal Security and Bug Bounty team on April 6; the vulnerability was patched by April 9. It was publicly disclosed by Vulnerability Laboratory on April 28.On his personal site, Solanki included another POC video and discussed finding a cross-site scripting (XSS) on PayPal. He said the PayPal Bug Bounty Program paid him $750. Related content news Dow Jones watchlist of high-risk businesses, people found on unsecured database A Dow Jones watchlist of 2.4 million at-risk businesses, politicians, and individuals was left unprotected on public cloud server. By Ms. Smith Feb 28, 2019 4 mins Data Breach Hacking Security news Ransomware attacks hit Florida ISP, Australian cardiology group Ransomware attacks might be on the decline, but that doesn't mean we don't have new victims. A Florida ISP and an Australian cardiology group were hit recently. By Ms. Smith Feb 27, 2019 4 mins Ransomware Security news Bare-metal cloud servers vulnerable to Cloudborne flaw Researchers warn that firmware backdoors planted on bare-metal cloud servers could later be exploited to brick a different customer’s server, to steal their data, or for ransomware attacks. By Ms. Smith Feb 26, 2019 3 mins Cloud Computing Security news Meet the man-in-the-room attack: Hackers can invisibly eavesdrop on Bigscreen VR users Flaws in Bigscreen could allow 'invisible Peeping Tom' hackers to eavesdrop on Bigscreen VR users, to discreetly deliver malware payloads, to completely control victims' computers and even to start a worm infection spreading through VR By Ms. Smith Feb 21, 2019 4 mins Hacking Vulnerabilities Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe