[Security-news] SA-CONTRIB-2013-040 - Commerce Skrill (Formerly Moneybookers) - Access bypass

[security-news at drupal.org]

View online: http://drupal.org/node/1960338

  * Advisory ID: DRUPAL-SA-CONTRIB-2013-040
  * Project: Commerce Skrill (Formerly Moneybookers) [1] (third-party module)
  * Version: 7.x
  * Date: 2013-April-03
  * Security risk: Critical [2]
  * Exploitable from: Remote
  * Vulnerability: Access bypass

-------- DESCRIPTION  
---------------------------------------------------------

This module integrates the Skrill online payment services [3] with Drupal
Commerce.

When processing Instant payment notifications (IPN), the "Moneybookers
enterprise" payment method provided by the Commerce Skrill contributed module
does not perform sufficient access checking, potentially allowing forged
notifications to be accepted as valid.

The vulnerability is mitigated by the fact that it only affects the
"Moneybookers enterprise" payment method.


-------- CVE IDENTIFIER(S) ISSUED  
--------------------------------------------

  * /A CVE identifier [4] will be requested, and added upon issuance, in
    accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED  
---------------------------------------------------

The "Moneybookers enterprise" payment method provided by the Commerce Skrill
[5] contributed module in all versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Commerce
Skrill (Formerly Moneybookers) [6] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version. The "Moneybookers enterprise" payment method now
requires the use of the hash security option.

  * Upgrade to Commerce Skrill 7.x-1.2 [7]
  * Go to the backoffice of Skrill and enable the securityHash verification
    following the Administration > Processing > Processing Settings section.
  * Get the security token, and paste it in the Secret key field of the
    payment method configuration form.

Also see the Commerce Skrill (Formerly Moneybookers) [8] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Julien Dubreuil [9] the module maintainer

-------- FIXED BY  
------------------------------------------------------------

  * Julien Dubreuil [10] the module maintainer
  * Jonathan Sacksick [11] the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Klaus Purer [12] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [13].

Learn more about the Drupal Security team and their policies [14], writing
secure code for Drupal [15], and securing your site [16].


[1] http://drupal.org/project/commerce_moneybookers
[2] http://drupal.org/security-team/risk-levels
[3] https://www.moneybookers.com/ads/partners/?p=Drupalcommerce
[4] http://cve.mitre.org/
[5] http://drupal.org/project/commerce_moneybookers
[6] http://drupal.org/project/commerce_moneybookers
[7] http://drupal.org/node/1959998
[8] http://drupal.org/project/commerce_moneybookers
[9] http://drupal.org/user/519520
[10] http://drupal.org/user/519520
[11] http://drupal.org/user/972218
[12] http://drupal.org/user/262198
[13] http://drupal.org/contact
[14] http://drupal.org/security-team
[15] http://drupal.org/writing-secure-code
[16] http://drupal.org/security/secure-configuration