Insecure Direct Object Reference in Jeepay Allows Unauthorized Deletion of Merchant Receivers

Executive Summary

Jeepay through version 3.2.9 has an Insecure Direct Object Reference (IDOR) vulnerability in the DELETE /api/divisionReceivers/{recordId} endpoint. Authenticated merchant users with ENT_DIVISION_RECEIVER_DELETE permission can delete other merchants' division receivers by manipulating an incorrect ownership check. If an attacker's receiver group ID matches a victim's receiver ID, the attacker can delete the victim's profit-sharing receiver.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for unauthorized DELETE requests to /api/divisionReceivers/{recordId} by users with ENT_DIVISION_RECEIVER_DELETE permission. Check if any user deletes receivers where their receiver group ID matches another user's receiver ID. Review access logs for suspicious activity patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to delete critical profit-sharing receivers for other merchants. It could lead to financial losses, disruption of services, or unauthorized changes to revenue distribution. The impact is limited to authenticated users with specific permissions but could cause significant operational issues if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Jeepay to the latest version beyond 3.2.9. Implement strict input validation to ensure users can only delete receivers they own. Review and revoke unnecessary ENT_DIVISION_RECEIVER_DELETE permissions. Monitor for any unauthorized deletions or suspicious activity.

Useful 0 Not Useful 0