CVE-2021-41120 (published 2021-10-05T21:15Z)

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled "credit card holder" field with the Customer\'s first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\\PayPalPlugin\\Controller\\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: [\'SCA_ALWAYS\'] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function callback.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-639
cwe_name: Authorization Bypass Through User-Controlled Key
description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
extended_description: 
            Retrieval of a user record occurs in the system based on some key value that is under user control. The key would typically identify a user-related record stored in the system and would be used to lookup that record for presentation to the user. It is likely that an attacker would have to be an authenticated user in the system. However, the authorization process would not properly check the data access operation to ensure that the authenticated user performing the operation has sufficient entitlements to perform the requested data access, hence bypassing any other authorization checks present in the system.
            For example, attackers can look at places where user specific data is retrieved (e.g. search screens) and determine whether the key for the item being looked up is controllable externally. The key may be a hidden field in the HTML form field, might be passed as a URL parameter or as an unencrypted cookie variable, then in each of these cases it will be possible to tamper with the key value.
            One manifestation of this weakness is when a system uses sequential or otherwise easily-guessable session IDs that would allow one user to easily switch to another user's session and read/modify their data.
         
         

Fix information:
repo_url: https://github.com/Sylius/PayPalPlugin
commit_details: repo_url: https://github.com/Sylius/PayPalPlugin
author: Mateusz Zalewski
author_date: 2021-10-04 15:57:45+02:00
msg: Require 3D Secure and process its response correctly
repository: repo_url: https://github.com/Sylius/PayPalPlugin
repo_name: Sylius/PayPalPlugin
description: Official integration with PayPal Commerce Platform
repo_language: PHP
owner: Sylius
file_changes: filename: payWithPaypal.html.twig
change_type: ModificationType.MODIFY
diff: @@ -329,6 +329,8 @@
         });
 
         if (paypal.HostedFields.isEligible() === true) {
+            let processingOrderId;
+
             paypal.HostedFields.render({
                 createOrder: function(data, actions) {
                     document.querySelector('#paypal-payment-container').classList.add('loading');
@@ -339,6 +341,8 @@
                     }).then(function(res) {
                         return res.json();
                     }).then(function(data) {
+                        processingOrderId = data.orderID;
+
                         return data.orderID;
                     });
                 },
@@ -419,6 +423,7 @@
 
                     if (formValid) {
                         hostedFields.submit({
+                            contingencies: ['SCA_ALWAYS'],
                             cardholderName: document.getElementById('card-holder-name').value,
                             billingAddress: {
                                 streetAddress: document.getElementById('card-billing-address-street').value,
@@ -428,20 +433,35 @@
                                 countryCodeAlpha2: document.getElementById('card-billing-address-country').value
                             }
                         }).then(payload => {
-                            return fetch(completePayPalOrderUrl, {
-                                method: 'post'
-                            }).then(function(res) {
-                                return res.json();
+                            if (payload.authenticationReason == 'SUCCESSFUL' && payload.authenticationStatus == 'YES') {
+                                return fetch(completePayPalOrderUrl, {
+                                    method: 'post'
+                                }).then(function(res) {
+                                    return res.json();
+                                }).then(function(data) {
+                                    if (data.status == 'processing') {
+                                        return fetch(cancelPayPalPaymentUrl, {
+                                            method: 'post',
+                                            headers: { 'content-type': 'application/json' },
+                                            body: JSON.stringify({ payPalOrderId: data.orderID })
+                                        }).then(window.location.reload());
+                                    }
+
+                                    window.location.href = data.return_url;
+                                });
+                            }
+
+
+                            return fetch(errorPayPalPaymentUrl, {
+                                method: 'post',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify('Invalid 3D Secure authentication.')
                             }).then(function(data) {
-                                if (data.status == 'processing') {
-                                    return fetch(cancelPayPalPaymentUrl, {
-                                        method: 'post',
-                                        headers: { 'content-type': 'application/json' },
-                                        body: JSON.stringify({ payPalOrderId: data.orderID })
-                                    }).then(window.location.reload());
-                                }
-
-                                window.location.href = data.return_url;
+                                return fetch(cancelPayPalPaymentUrl, {
+                                    method: 'post',
+                                    headers: { 'content-type': 'application/json' },
+                                    body: JSON.stringify({ payPalOrderId: processingOrderId })
+                                }).then(window.location.reload());
                             });
                         });
                     } else {

programming_language: HTML
repo_url: https://github.com/Sylius/PayPalPlugin
commit_details: repo_url: https://github.com/Sylius/PayPalPlugin
author: Mateusz Zalewski
author_date: 2021-10-05 21:45:14+02:00
msg: Merge pull request from GHSA-25fx-mxc2-76g7

Secure pay with PayPal form URL with order token + require 3D Secure
repository: repo_url: https://github.com/Sylius/PayPalPlugin
repo_name: Sylius/PayPalPlugin
description: Official integration with PayPal Commerce Platform
repo_language: PHP
owner: Sylius