Insufficient Data Authenticity Check in Mews POS

Executive Summary

This vulnerability affects the mews/pos library up to version 2.0.0. It involves insufficient verification of data authenticity in payment callbacks for 3D Pay and 3D Host transactions. Specifically, the GarantiPos, PayForPos, and InterPos handlers skip cryptographic hash verification, allowing unauthenticated attackers to forge payment results by submitting tampered data such as status, amount, or order ID fields. This enables attackers to complete orders without making actual payments.

Useful 0 Not Useful 0

Detection Guidance

Check if your mews/pos library version is 2.0.0 or earlier. Review callback handling code for GarantiPos, PayForPos, and InterPos gateways to confirm if check3DHash() verification is missing. Look for unauthorized payment completions without actual transactions.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected mews/pos library, attackers could exploit this flaw to trick the system into processing fake payments. This could result in financial losses as orders are marked as paid without actual transactions occurring. The vulnerability affects payment integrations with multiple Turkish banks like Garanti, İşbank, and Ziraat.

Useful 0 Not Useful 0

Mitigation Strategies

Update mews/pos to the latest version that includes hash verification in callback processing. Ensure GarantiPos, PayForPos, and InterPos gateways enforce check3DHash() validation. Monitor payment logs for tampered callback parameters.

Useful 0 Not Useful 0