Unsafe deserialization leads to token leakage in PayPal & PayPal for Business [Android]

Summary

A Bug Bounty researcher identified an issue where a JSON wrapper could be used to instantiate arbitrary Java objects. This could lead to circumstances where a class called in the PayPal Android app could be read by a malicious app on the same mobile device. A specific user’s session data could potentially be disclosed, including API tokens. PayPal’s investigation found no evidence of abuse due to this bug, and the issue was resolved on November 15, 2019.

https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/

This vulnerability was reported as a result of joint research with khilly. We found that insecure deserialization allowed certain Java classes in the PayPal Android app to be accessed by a malicious app on the same device. This could have exposed API tokens and session information. Khilly contributed directly to the technical analysis and reproduction of the issue. We disclosed it through HackerOne, and PayPal confirmed and fixed the vulnerability.