According to Roman Zaikin, a researcher with Check Point, there is vulnerability on EBay that would allow a page to open that could expose user to phishing attacks and data theft.

The sites code validation could be circumvented and execute malicious JavaScript on users via their browser. The vulnerability was disclosed on Dec. 15th last year, but the company said it had no plans to fix it.

“As we demonstrated to the eBay security team in the proof of concept, we were able to bypass their security policies and insert a malicious code to our seller page without any difficulty or restriction,” the firm writes.

If a hacker created a store and used a new programming language (JSF**k), eBay would then unknowingly load additional script from the attackers’ own server.



Since JSF**k only uses six different characters – []()!+, and eBay only strips alpha-numeric ones from inside tags, attackers could bypass protections put up by the company.

“This allows the attacker to insert a remote controllable JavaScript that he can adjust to, for example, create multiple payloads for a different user agent,” Check Point writes, adding that an attacker could use it to trick a victim into downloading a malicious app or use the vulnerability to carry out phishing attacks.

Source: ThreatPost