Authorization Bypass in Lago via Stripe Invoice Manipulation

Executive Summary

Lago through version 1.55.0 has an authorization bypass flaw in the Invoices::Payments::StripeService component. This allows users from one organization to mark invoices belonging to another organization as paid due to improper invoice lookup scoping. Attackers with control over their organization's Stripe integration can exploit this by sending a crafted payment_intent.succeeded event containing a victim's invoice UUID, enabling unauthorized wallet top-ups or access to payment-gated subscriptions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Stripe webhook events for suspicious invoice payment updates. Check logs for payment_intent.succeeded events where the invoice UUID does not belong to the requesting organization. Verify if the system uses unscoped Invoice.find_by(id:) queries in the one-time payment path.

Useful 0 Not Useful 0

Impact Analysis

If you use Lago with Stripe integration, an attacker in another organization could exploit this to mark your invoices as paid without actual payment. This could lead to unauthorized wallet top-ups or access to services restricted by payment status, potentially causing financial loss or service disruption for your organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to financial data across organizations. Unauthorized invoice payment manipulation may lead to improper data exposure or financial transactions, which could conflict with data protection and privacy requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Lago to a version later than 1.55.0 to address the authorization bypass in Invoices::Payments::StripeService. Ensure proper scoping of invoice lookups to prevent unauthorized access.

Useful 0 Not Useful 0