Unauthenticated payment reuse allows unpaid orders to be marked as paid
Résumé
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
- commerceTransactionHash — selects which Craft Commerce transaction is completed
- id — selects which Mollie payment is queried for its status
An unauthentica...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
commerce-mollie の Mollie webhook エンドポイントでは、取引と決済IDの対応が検証されません。認証なしの攻撃者が、加盟店の支払い済み Mollie 決済IDを別の取引に組み合わせると、未払いの注文が全額支払い済みとして処理される可能性があります。影響を受けるのは 2.1.1 以上 4.4.3 未満で、修正版は 4.4.3 です。速やかに 4.4.3 以降へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| craftcms | commerce-mollie |
≥ 2.1.1, < 4.4.3 |
4.4.3 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
- commerceTransactionHash — selects which Craft Commerce transaction is completed
- id — selects which Mollie payment is queried for its status
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full
amount, regardless of how much was actually paid.
Source: CVE.org (CVE Program・cvelistV5) NVD
Références
- web hckrt.com
- web github.com
- web github.com
- web github.com