Ryan Szrama

Improper verification of cryptographic signatures in the module allows for signature spoofing. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook event signatures. Webhooks are automated messages sent from Stripe to the application to notify it about events, such as successful payments.

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). This issue occurs when the module is used to configure the store via the Stripe Connect API. Exploitation requires the attacker to possess administrator permissions to configure payment gateways and the simultaneous compromise of an external service.

An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment.

The issue is related to a lack of authorization in the Drupal Entity Delete Log, which allows for forceful browsing. This can enable a remote attacker to bypass security restrictions and perform a forceful browsing attack.