CVE-2020-36285 : What You Need to Know

Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347 vulnerability that allows attackers to shop for free in merchants' websites and mobile apps.

Understanding CVE-2020-36285

This CVE involves an Improper Verification of Cryptographic Signature vulnerability in Union Pay.

What is CVE-2020-36285?

The vulnerability in Union Pay up to version 3.3.12 for iOS mobile apps allows attackers to make purchases without payment through a crafted authentication code.

The Impact of CVE-2020-36285

Attackers can exploit this vulnerability to shop for free in merchants' websites and mobile apps by using a specially crafted authentication code.

Technical Details of CVE-2020-36285

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability involves improper verification of cryptographic signatures in Union Pay, enabling attackers to generate a crafted authentication code for free shopping.

Affected Systems and Versions

Affected System: Union Pay up to version 3.3.12 for iOS mobile apps
Affected Version: 3.3.12

Exploitation Mechanism

Attackers exploit the vulnerability by generating a crafted authentication code (MAC) based on a NULL secret key.

Mitigation and Prevention

Protect your systems and data from this vulnerability.

Immediate Steps to Take

Update Union Pay to the latest version to patch the vulnerability.
Monitor transactions for any suspicious activity.
Implement multi-factor authentication for added security.

Long-Term Security Practices

Regularly update and patch all software and applications.
Conduct security audits and penetration testing to identify vulnerabilities.
Educate users and employees on safe online practices.

Patching and Updates

Apply security patches promptly to fix known vulnerabilities and enhance system security.