PT-2019-9762 · Stripe · Stripe Api

Published 2019-01-03 · Updated 2019-01-31 · CVE-2018-19249

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stripe API v1

Description The issue allows remote attackers to bypass intended access restrictions. This is achieved by replaying XMLHttpRequest data to the API endpoint "/v1/tokens" on api.stripe.com, then parsing the response under the object card{}, and reading the cvc check information if the creation is successful without charging the actual card used in the transaction.

Recommendations For Stripe API v1, as a temporary workaround, consider restricting access to the /v1/tokens API endpoint until a patch is available. Avoid using the cvc check information in the response under the card{} object until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-19249

Affected Products

Stripe Api

References · 3

• https://osv.dev/vulnerability/CVE-2018-19249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19249 · Security Note
• https://fredmooredamian.blogspot.com/2019/01/improper-authentication-on-stripe-api-v1.html · Note