[CVE-2024-41670] Improperly Implemented Security Check for Standard in PayPal Official for PrestaShop

In the module “PayPal Official” for PrestaShop 1.7+ release <= 6.4.1 and for PrestaShop 1.6 release <= 3.18.0, a malicious customer can confirm as “payment accepted” an order even if payment is finally declined by PayPal.

Summary

CVE ID: CVE-2024-41670
Published at: 2024-07-25
Advisory source: Github repository of Paypal module for PrestaShop
Platform: PrestaShop
Product: paypal
Impacted release: <= 6.4.1 (6.4.2 fix the vulnerability) / <= 3.18.0 (3.18.1 fix the vulnerability)
Product author: 202 ecommerce
Weakness: CWE-358
Severity: medium (6.5)

Description

Before to 6.4.1 or 3.18.1, a logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order.

CVSS base metrics

Attack vector: network
Attack complexity: low
Privilege required: low
User interaction: none
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: low

Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Possible malicious usage

Confirm order with a fraudulent payment support

Other recommendations

Upgrade PayPal up to 6.4.2 or 3.18.1 according to your PrestaShop version.
Enable webhooks and check they are callable

Timeline

Date	Action
2024-07-15	Issue discovered in a support ticket
2024-07-17	202 ecommerce inform PayPal of a suspicious transaction
2024-07-22	Logical weakness confirmed in a testing environment
2024-07-25	Publication of this advisory with releases patch