eBay Inc. Cross Site Scripting / Filtration Bypass

[Aerosol]

Threat Level: High
Severity: High
CVSS Severity score: 7.0
Impact: Complete Integrity, Confidentiality, and Availability violation.
EBay Reference: #EIBBP-31480
Vulnerability:
(1) Unauthenticated Cross-Site Scripting Vulnerability
(1) Filtration Bypass
Vendor Overview
“eBay Inc. is an American multinational corporation and e-commerce company, providing consumer to
consumer & business to consumer sales services via Internet. It is headquartered in San Jose, California, United
States. The company manages eBay.com, an online auction and shopping website in which people and
businesses buy and sell a broad variety of goods and services worldwide. In addition to its auction-style sales,
the website has since expanded to include "Buy It Now" shopping; shopping by UPC, ISBN, or other kind of
SKU (via Half.com); online classified advertisements (via Kijiji or eBay Classifieds); online event ticket
trading (via StubHub); online money transfers (via PayPal) and other services. eBay was founded by Pierre
Omidyar in 1995, and became a notable success story of the dot-com bubble; it is a multi-billion dollar business
with operations localized in over thirty countries.” [1] [2]

Description
Application data utilizes in its output, user input that is not validated or properly encoded.
The application is vulnerable to an unauthenticated Cross-Site Scripting attack.
Vulnerabilities that permit these attacks, are widespread and persist anywhere a web application makes use of
user input without any security validation controls.
A malicious adversary can use this to compromise the trust of unsuspecting users, by tricking them into visiting
a seemingly benign and trusted site. The malicious payload is embedded within a seemingly benign URL.
This way an attacker can steal user credentials, to hijack a user’s session, to force a redirection to a
heterogeneous third-party website, and thus to force a user’s browser to execute unsafe actions on behalf of the
attacker. [3] [4]
In this attack scenario it is noted that “Visitor -> Vendor” trust-levels are directly impacted. 

Read more: http://dl.packetstormsecurity.net/1503-exploits/eBay030315.pdf