N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-mqq7-wxx5-mp8h

GHSA-mqq7-wxx5-mp8h: ps_checkout allows unauthorized method invocation through unvalidated parameter

Impact

Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.

Patches

The problem has been patched in versions

v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0)
v5.3.0 for PrestaShop 8 (build number: 8.5.3.0)
v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)

Read the Versioning policy to learn more about the build numbers.

Credits

PrestaShop thanks PATICEO for reporting the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-mqq7-wxx5-mp8h

GHSA-mqq7-wxx5-mp8h:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
prestashop/ps_checkout	composer	< 5.3.0	5.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'unauthorized method invocation through unvalidated parameter', stems from a two-part issue within the ps_checkout module's payment authorization process. The primary entry point is the ajaxProcessCaptureAuthorization method in the AdminAjaxPrestashopCheckoutController, which is accessible to administrative users. This function improperly constructed API request payloads for PayPal, particularly when an amount was provided without a currency. This malformed request would cause the PayPal API to return an error.

The second part of the vulnerability lies in the handling of this API response. The CaptureAuthorizationAction.execute and VoidAuthorizationAction.execute methods would decode the JSON response from PayPal but failed to validate whether the decoding was successful. In the case of an error response, the decoded value would be null. The subsequent code, however, proceeded as if a valid object was returned, leading to PHP errors when trying to access array keys on a null value. This unhandled error state is what creates the potential for 'unauthorized method invocation' mentioned in the advisory.

The patch rectifies these issues by first, fixing the payload construction logic in AdminAjaxPrestashopCheckoutController to ensure a valid request is always sent. Second, it adds explicit checks in CaptureAuthorizationAction.execute and VoidAuthorizationAction.execute to validate the decoded API response and throw an exception if it's invalid, thus preventing the application from entering an unstable state.

Vulnerable functions

AdminAjaxPrestashopCheckoutController.ajaxProcessCaptureAuthorization

ps17/controllers/admin/AdminAjaxPrestashopCheckoutController.php

This function, present in controllers for PrestaShop versions 1.7, 8, and 9, takes user-controlled input ('amount', 'currency') via an AJAX request. The original code constructed a payload for the PayPal API. A flaw in the logic allowed for a payload to be created with an 'amount' but without a 'currency_code' if the currency was not provided in the request. This would generate an invalid request to the PayPal API, which is the entry point for triggering the vulnerability.

PsCheckout\Core\PayPal\Payment\Authorization\Action\CaptureAuthorizationAction.execute

core/src/PayPal/Payment/Authorization/Action/CaptureAuthorizationAction.php

This method processes the response from a PayPal capture request. Before the patch, it did not validate the result of `json_decode` on the response body. A malformed response from PayPal (which could be triggered by the flawed payload from `ajaxProcessCaptureAuthorization`) would result in `$capturedAuthorization` being `null`. The subsequent code would then attempt to access this `null` value as an array, leading to an unhandled error and unpredictable behavior, described as 'unauthorized method invocation'.

PsCheckout\Core\PayPal\Payment\Authorization\Action\VoidAuthorizationAction.execute

core/src/PayPal/Payment/Authorization/Action/VoidAuthorizationAction.php

Similar to `CaptureAuthorizationAction.execute`, this method processes a response from a PayPal void request. It was also missing validation on the `json_decode` result. An invalid response from the PayPal API would cause `$voidedAuthorization` to be `null`, leading to errors and potential exploitation when the code attempts to use this variable.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.