PT-2018-4156 · Paypal · Paypal-Ipn

Published 2018-05-29 · Updated 2020-08-31 · CVE-2014-10067

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions paypal-ipn versions 2.x.x and earlier paypal-ipn versions prior to 3.0.0

Description The issue concerns a validation bypass vulnerability. paypal-ipn uses the test ipn parameter, set by the PayPal IPN simulator, to determine whether to use the production PayPal site or the sandbox. An attacker could craft a request using the simulator to fool an application into entering sandbox mode, potentially allowing purchases without valid payment.

Recommendations For versions 2.x.x and earlier, upgrade to version 3.0.0 or later. As a temporary workaround, consider explicitly checking for the test ipn parameter in production to prevent validation bypass.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-10067

GHSA-H698-R4HM-W94P

Affected Products

Paypal-Ipn

References · 6

• https://osv.dev/vulnerability/GHSA-h698-r4hm-w94p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-10067 · Security Note
• https://npmjs.com/advisories/26 · Note
• https://nodesecurity.io/advisories/26 · Note
• ❌ https://github.com/andzdroid/paypal-ipn/issues/11 · Note, Deleted
• ❌ https://github.com/andzdroid/paypal-ipn · Note, Deleted