CVE-2020-8818 : Security Advisory and Response

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2, allowing attackers to manipulate critical plugin settings and bypass the payment process.

Understanding CVE-2020-8818

This CVE involves a lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php, enabling attackers to alter plugin settings and potentially receive subsequent payments.

What is CVE-2020-8818?

The vulnerability in the CardGate Payments plugin for Magento 2 allows attackers to replace essential plugin settings, such as merchant ID and secret key, leading to payment process bypass and potential payment receipt without actual transactions.

The Impact of CVE-2020-8818

The exploitation of this vulnerability can result in unauthorized access to critical payment settings, manipulation of order statuses, and potential financial losses for merchants using the affected plugin.

Technical Details of CVE-2020-8818

This section provides detailed technical insights into the CVE.

Vulnerability Description

The lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows remote attackers to modify crucial plugin settings, compromising the payment process.

Affected Systems and Versions

Product: Not applicable
Vendor: Not applicable
Versions affected: Up to 2.0.30 of the CardGate Payments plugin for Magento 2

Exploitation Mechanism

Attackers can exploit this vulnerability by sending a crafted IPN callback request with a valid signature but without actual payment, enabling them to manipulate plugin settings and potentially receive payments.

Mitigation and Prevention

Protecting systems from CVE-2020-8818 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update the CardGate Payments plugin to the latest version that includes a patch for this vulnerability.
Monitor payment transactions for any suspicious activities or unauthorized changes.

Long-Term Security Practices

Implement strong authentication mechanisms for payment processing functions.
Regularly audit and review plugin settings and configurations to detect any unauthorized changes.

Patching and Updates

Apply security patches provided by the plugin vendor promptly to address known vulnerabilities and enhance the security of the payment processing system.