Tom Ashe

A missing authorization issue allows forceful browsing and access bypass. The flaw stems from insufficient protection of routes and entity fields, enabling unauthenticated attackers to perform privileged actions, manipulate orders, and access customer payment data or personally identifiable information (PII). This issue affects the shopping cart, checkout, and API functionality. It is estimated that over 42,000 deployments are affected. There are confirmed reports of active exploitation in the wild, including instances of fraudulent orders on live websites.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify access to the relationship between promotions and coupons. Consequently, a user authorized only to manage their own promotions can modify or delete coupons associated with other promotions. This issue is mitigated if the site does not enable writes through JSON:API or REST, as these are disabled by default.

An incorrect authorization issue allows forceful browsing when a store is saved. The system fails to properly verify access permissions, enabling a user with the ability to create stores or edit their own store to mark it as the site's default store. This allows the user to receive orders they are not authorized to access. This issue primarily impacts sites that grant these permissions to untrusted users, such as marketplace platforms where vendors manage their own stores.

An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to license fields for users possessing the `update own commerce license` permission. Consequently, a license owner can modify the license state and the rights granted by their license, potentially leading to privilege escalation up to the Administrator role.

An incorrect authorization issue allows forceful browsing within the module used for organizing tangible products into shipments for fulfillment. The module fails to sufficiently protect shipment references and shipment entity fields, leading to an access bypass. This can result in the unauthorized modification of shipment states or the deletion of shipments. Exploitation requires the attacker to possess a cart with API-based access to manipulate shipments.

A Cross-Site Request Forgery (CSRF) issue exists in the module used for Stripe Connect API integration. When redirecting to Stripe Connect to generate an authorization code, the module fails to include a CSRF token in the return URI. This allows an attacker to deceive an administrator into clicking a link that bypasses the payment process, resulting in orders being marked as paid without actual payment being processed.

Improper verification of cryptographic signatures in the module allows for signature spoofing. The issue occurs when a signing secret is not properly configured in the payment gateway settings, leading to insufficient verification of webhook event signatures. Webhooks are automated messages sent from Stripe to the application to notify it about events, such as successful payments.

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). This issue occurs when the module is used to configure the store via the Stripe Connect API. Exploitation requires the attacker to possess administrator permissions to configure payment gateways and the simultaneous compromise of an external service.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment.