Authorization Bypass in CorvusPay WooCommerce Payment Gateway

Detection Guidance

This vulnerability can be detected by monitoring requests to the /wp-json/corvuspay/cancel/ REST endpoint, especially those that include arbitrary order numbers. Unauthenticated requests attempting to cancel orders via this endpoint may indicate exploitation attempts.

You can use network monitoring tools or web server logs to identify such requests. For example, using command line tools like curl to test the endpoint with different order numbers can help verify if unauthorized cancellation is possible.

• curl -X POST https://yourwordpresssite.com/wp-json/corvuspay/cancel/ -d 'order_number=12345'
• grep '/wp-json/corvuspay/cancel/' /var/log/apache2/access.log
• Use intrusion detection systems (IDS) or web application firewalls (WAF) to alert on unauthenticated POST requests to the vulnerable endpoint.

Useful 0 Not Useful 0

Executive Summary

The CorvusPay WooCommerce Payment Gateway plugin for WordPress has a vulnerability in all versions up to and including 2.7.4 where it does not properly verify if a user is authorized to perform certain actions.

Because of this, an unauthenticated attacker can bypass authorization checks and cancel any WooCommerce order made through the CorvusPay payment method by providing an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to cancel legitimate WooCommerce orders placed via the CorvusPay payment method without proper authorization.

Such unauthorized cancellations can disrupt business operations, cause financial losses, and damage customer trust.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the CorvusPay WooCommerce Payment Gateway plugin to a version later than 2.7.4 where this authorization bypass vulnerability is fixed.

If updating is not immediately possible, restrict access to the /wp-json/corvuspay/cancel/ REST endpoint by implementing authentication checks or firewall rules to block unauthenticated requests.

Additionally, monitor your logs for suspicious cancellation attempts and consider temporarily disabling the CorvusPay payment method until a patch is applied.

Useful 0 Not Useful 0