Description
The Commerce Ingenico module integrates Drupal Commerce with the Ingenico (Ogone) payment platform and exposes a public callback endpoint that Ingenico calls back to after a 3D Secure authentication.
The module does not validate the Ingenico SHA signature in the 3D Secure callback handler before acting on the request, so it sets the order status to pending, saves the order, and creates a payment transaction with the order total amount and a captured status purely on the basis of request parameters that the client controls. Because the callback endpoint is public and requires no authentication, any remote user who knows or guesses a valid order identifier can send a single request to mark that order as paid and inject a fabricated captured payment transaction.
This vulnerability is mitigated by the fact that the attacker needs a valid order identifier that already has an Ingenico payment method associated with it, although such an order is easy to create through a normal checkout and order identifiers are sequential and enumerable.
Solution
Install the latest version.
If you use the Commerce Ingenico module for Drupal 7, upgrade to Commerce Ingenico 7.x-1.7:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES