Payment Bypass in CorvusPay WooCommerce Plugin

Compliance Impact

This vulnerability allows unauthenticated attackers to mark WooCommerce orders as paid without actual payment, potentially leading to unauthorized acquisition of goods or services.

While the CVE description does not explicitly mention compliance with standards such as GDPR or HIPAA, the ability to bypass payment verification could lead to financial fraud and unauthorized transactions, which may indirectly impact compliance with regulations that require secure transaction processing and protection against fraud.

However, there is no direct information provided about specific impacts on data privacy regulations or healthcare-related compliance.

Useful 0 Not Useful 0

Executive Summary

The CorvusPay WooCommerce Payment Gateway plugin for WordPress has a vulnerability in versions up to 2.7.4 where the cryptographic signature verification is improperly handled. Specifically, the function that processes payment success requests does not properly check if the signature is valid before marking an order as paid. Although the signature validation result is logged, it is not used to conditionally allow payment completion. This flaw allows attackers to send a forged or arbitrary signature in a POST request to the payment success endpoint and mark any pending WooCommerce order as paid without actually making a payment.

Because WooCommerce order IDs are sequential integers, attackers can easily guess order numbers and exploit this vulnerability without prior knowledge of specific orders.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthenticated attackers to fraudulently mark orders as paid, enabling them to obtain goods or services without paying. This can lead to financial losses for merchants using the CorvusPay WooCommerce Payment Gateway plugin.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized POST requests to the REST endpoint /wp-json/corvuspay/success/ on your WordPress site. Since the vulnerability allows unauthenticated attackers to mark orders as paid by sending forged signatures, inspecting web server logs for unusual or unexpected POST requests to this endpoint with arbitrary order_number parameters can help identify exploitation attempts.

You can use commands such as the following to search your web server logs for suspicious activity:

• grep 'POST /wp-json/corvuspay/success/' /var/log/apache2/access.log
• grep 'POST /wp-json/corvuspay/success/' /var/log/nginx/access.log
• Use tools like curl or wget to test the endpoint manually by sending POST requests with arbitrary order_number and signature values to see if orders are marked as paid without proper verification.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should update the CorvusPay WooCommerce Payment Gateway plugin to a version later than 2.7.4 where the issue is fixed.

If an update is not immediately available, consider disabling or restricting access to the vulnerable REST endpoint /wp-json/corvuspay/success/ to prevent unauthenticated POST requests.

Additionally, monitor your WooCommerce orders for any suspicious payment completions that may have been triggered without proper payment.

Useful 0 Not Useful 0