gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
go-pay:gopay
References 5
https://github.com/go-pay/gopay
disclosure@vulncheck.com
https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37
disclosure@vulncheck.com
https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd
disclosure@vulncheck.com
https://github.com/go-pay/gopay/issues/540
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certific…
disclosure@vulncheck.com