{"id":1088,"date":"2023-06-16T10:48:22","date_gmt":"2023-06-16T10:48:22","guid":{"rendered":"https:\/\/certerassl.com\/blog\/?p=1088"},"modified":"2023-06-16T10:52:48","modified_gmt":"2023-06-16T10:52:48","slug":"a-security-vulnerability-in-woocommerce-stripe-gateway-affects-over-900k-websites","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/a-security-vulnerability-in-woocommerce-stripe-gateway-affects-over-900k-websites\/","title":{"rendered":"A Security Vulnerability in WooCommerce Stripe Gateway Affects Over 900K Websites"},"content":{"rendered":"\n

A security vulnerability was discovered in the WooCommerce Stripe payment gateway plugin, making it possible for an attacker to collect personally identifiable information (PII) from stores using the plugin.<\/p>\n\n\n\n

Security analysts rated the attack a high grade of 7.5 on a rating scale of 1 to 10, and it does not require authentication.<\/em><\/strong><\/p>\n\n\n\n

WooCommerce Stripe Payment Gateway Plugin<\/h2>\n\n\n\n

Stripe payment gateway plugin, created by WooCommerce, Automattic, WooThemes, and other developers.<\/p>\n\n\n\n

It offers a simple way for customers to check out at WooCommerce stores using various credit cards without creating an account.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

A Stripe account is automatically generated at checkout, providing customers with a seamless e-commerce purchasing experience.<\/p>\n\n\n\n

The plugin uses an application programming interface (API) to function.<\/p>\n\n\n\n

An API acts as an intermediary between two applications, enabling smooth order processing from the WooCommerce shop to Stripe through interaction between the two.<\/p>\n\n\n\n

What does the WooCommerce Stripe Plugin vulnerability Entail?<\/h2>\n\n\n\n

The vulnerability was found by security experts at Patchstack,<\/strong> who appropriately informed the right parties involved.<\/p>\n\n\n\n

Security professionals at WordPress security companyPatchstack (which discovered the vulnerability) say:<\/p>\n\n\n\n

“This plugin has an IDOR vulnerability, which stands for Unauthenticated Insecure Direct Object Reference.<\/em><\/strong><\/p>\n\n\n\n

Due to a vulnerability, any user without authentication can view the email, username, and complete address of any WooCommerce order. The described vulnerability was fixed in version 7.4.1 with some backported fixed versions and assigned CVE-2023-34000.<\/em><\/strong><\/p>\n\n\n\n

The issues allow an attacker to read order information in the site’s page source or on the front end due to the lacking of order ownership checks.”<\/em><\/strong><\/p>\n\n\n\n

The ‘javascript_params<\/strong>‘ and ‘payment_fields<\/strong>‘ routines lack sufficient access control and handle data unsafely, resulting in a security flaw.<\/p>\n\n\n\n

Recommended: Unauthenticated IDOR to PII Disclosure in WooCommerce Stripe Gateway Plugin<\/a><\/strong><\/p>\n\n\n\n

More than 900,000 active installations of the plugin exist, and based on the version use statistics that are currently accessible, hundreds of thousands of them could potentially be attacked.<\/p>\n\n\n\n

Impact of the WooCommerce Stripe Plugin Versions<\/h2>\n\n\n\n

Versions 7.4.0 and earlier are affected by the vulnerability.<\/p>\n\n\n\n

The developers upgraded the plugin to version 7.4.1, the most secure version.<\/p>\n\n\n\n

According to the official plugin changelog, the following updates to security were made:<\/strong><\/p>\n\n\n\n

“Fix \u2013 Add Order Key Validation.<\/em><\/strong><\/em><\/p>\n\n\n\n

Fix \u2013 Add sanitization and escaping some outputs.”<\/em><\/strong><\/em><\/p>\n\n\n\n

There are specific issues that are required to be resolved.<\/p>\n\n\n\n

The first is a lack of validation, often a check to identify whether a request comes from a legitimate source.<\/p>\n\n\n\n

The second one is sanitization, which describes a method of preventing any invalid input. For instance, if a field accepts just text, it should be configured so scripts cannot be uploaded.<\/p>\n\n\n\n

Patchstack’s security advisory provided more technical information regarding the root causes of the vulnerabilities that this version addresses. <\/p>\n\n\n\n

Store owners are strongly advised to upgrade to version 7.4.1.<\/em><\/strong><\/p>\n\n\n\n

Recent Vulnerabilities of 2023<\/h3>\n\n\n\n