Authentication Bypass in Chaskiq via Stripe Subscription Manipulation

Executive Summary

This is a missing authentication vulnerability in Chaskiq that allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent creation to unauthenticated callers. An attacker can create payment intents and alter billing for any tenant without credentials.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated GraphQL mutations in Chaskiq, specifically the stripeCreateIntent endpoint. Inspect network traffic for GraphQL requests to this mutation without valid authentication tokens. Look for POST requests to /graphql with the mutation query containing stripeCreateIntent and missing Authorization headers.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create unauthorized payment intents and modify billing for any tenant, potentially leading to financial loss or fraudulent transactions. Since the vulnerability allows unauthenticated access, any system using Chaskiq with Stripe integration is at risk of unauthorized subscription manipulation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and modification of payment data, violating compliance requirements for data protection and financial integrity. GDPR may be impacted due to unauthorized processing of personal data, while HIPAA could be affected if payment data involves protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Chaskiq to the latest commit or patch that includes authentication checks for the stripeCreateIntent mutation. If no patch is available, disable the GraphQL endpoint or restrict access via firewall rules until a fix is applied. Review all Stripe subscriptions for unauthorized changes.

Useful 0 Not Useful 0