Contrib.social

Webhook calls are not verified, allowing to fake successful payments

Open on Drupal.org →
Created on 25 September 2023, over 1 year ago
Updated 5 October 2023, over 1 year ago

This issue was reported by tcrawford via email. Due to the sensitive nature, the project has been patched before creating this issue.

Problem/Motivation

The WebhookController::transactionHandler() method is trusting (without any verification mechanism) the data in the incoming webhook request, whereas the PaymentResponseService::onReturn() method is making a request back to the remote server in order to get verified data on the transaction.

This would allow an actor to craft a request to the webhook to complete a payment while on the remote payment gateway without entering any valid payment credentials.

Steps to reproduce

/

Proposed resolution

- Secure webhook endpoint by confirming transaction data with Payrexx gateway.

Remaining tasks

- Apply patch provided by

User interface changes

- none

API changes

- PaymentResponseService has been deleted and replaced by TransactionHandlerService and GatewayPluginInstanceGetterTrait

Data model changes

- none

🐛 Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

🇨🇭Switzerland pvbergen

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024