Stored XSS in CorvusPay WooCommerce Payment Gateway Plugin

Executive Summary

The CorvusPay WooCommerce Payment Gateway plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'approval_code' parameter in all versions up to and including 2.7.4. This vulnerability arises because the plugin does not properly sanitize input or escape output. An unauthenticated attacker can exploit this by injecting malicious scripts into pages that will execute whenever a user views the infected page.

The vulnerability is worsened by the fact that the REST endpoint POST /wp-json/corvuspay/success/ is accessible without authentication (permission_callback set to always true). Although there is a signature validation step, it only logs the validation result and does not stop execution, allowing attackers to submit arbitrary signatures and store malicious approval_code values in the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to inject and execute arbitrary JavaScript code in the context of the affected website. This can lead to theft of user credentials, session hijacking, defacement of the website, or redirection to malicious sites.

Because the attack can be performed without authentication, any visitor to the affected site could be exposed to malicious scripts, increasing the risk of widespread compromise.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the CorvusPay WooCommerce Payment Gateway plugin version 2.7.4 or earlier is installed and if the REST endpoint POST /wp-json/corvuspay/success/ is accessible without proper signature validation.

You can check for suspicious stored scripts in the database related to the 'approval_code' parameter, which may indicate exploitation.

Suggested commands include using curl or similar tools to test the REST endpoint for acceptance of arbitrary signatures and injection attempts.

• curl -X POST https://yourwordpresssite.com/wp-json/corvuspay/success/ -d 'approval_code=<script>alert(1)</script>&signature=arbitrary'
• Search the WordPress database for suspicious approval_code entries, for example using SQL: SELECT * FROM wp_options WHERE option_name LIKE '%approval_code%' AND option_value LIKE '%<script>%';

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the CorvusPay WooCommerce Payment Gateway plugin to a version later than 2.7.4 where the vulnerability is fixed.

If an update is not immediately possible, restrict access to the vulnerable REST endpoint by implementing proper authentication or firewall rules to block unauthenticated POST requests to /wp-json/corvuspay/success/.

Additionally, review and sanitize any stored approval_code values in the database to remove malicious scripts.

Useful 0 Not Useful 0