Insecure currencyCode handling in @vendure/core allows wrong payment amounts
Summary
GHSA-wm63-7627-ch33: @vendure/core's insecure currencyCode handling allows wrong payment amounts. Affects @vendure/core versions < 2.1.3. Fixed in 2.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @vendure/core package is an open-source e-commerce framework that provides a flexible and extensible platform for building online stores. It offers various features such as product management, order processing, and payment integration. However, a vulnerability has been identified in the currencyCode handling functionality of the package, which can lead to incorrect payment amounts being processed.
Vulnerability Detail
The vulnerability allows users to select any currencyCode, even if it is not assigned to the channel, and make payments through payment gateways such as Mollie and Stripe. The prices are not properly transformed, resulting in the order being settled in a foreign currency. This can lead to financial loss for the merchant and confusion for the customers. The root cause of this vulnerability is the ability to specify an arbitrary currencyCode as a query parameter, which is then used throughout the system without proper validation. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.1.3
This is the first release that contains the fix.
npm install @vendure/core@2.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the patched version is not immediately feasible, a temporary workaround can be implemented by defining a custom OrderProcess onTransitionStart function. This function can verify the order's currencyCode before allowing the transition to the ArrangingPayment state. Here is an example of how the workaround can be implemented:
const customOrderProcess = new OrderProcess({
onTransitionStart(fromState, toState, data) {
const { order } = data;
if (order.currencyCode !== 'EXPECTED_CURRENCY_CODE') {
throw new Error('Invalid currencyCode');
}
},
});
Conclusion
The @vendure/core package is vulnerable to an insecure currencyCode handling issue, which can result in incorrect payment amounts and orders being settled in foreign currencies. It is recommended to update to version 2.1.3 or later to fix this vulnerability. If immediate update is not feasible, a temporary workaround can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @vendure/core →
FAQ
The vulnerability allows users to make payments in any currency, even if it is not assigned to the channel. This can result in incorrect payment amounts and orders being settled in foreign currencies, leading to financial loss for the merchant and confusion for the customers.
To fix this vulnerability, update the @vendure/core package to version 2.1.3 or later. This version includes a patch that adds validation to the currencyCode and recalculates prices when the currencyCode changes.
Yes, all versions of @vendure/core prior to version 2.1.3 are affected by this vulnerability. It is recommended to update to the latest version to ensure the security of your application.
Yes, you can still use payment gateways like Mollie and Stripe with the patched version of @vendure/core. The patch ensures that the currencyCode is validated and prices are correctly calculated, preventing incorrect payment amounts.
Yes, a temporary workaround is available by defining a custom OrderProcess onTransitionStart function. This function can verify the order's currencyCode before allowing the transition to the ArrangingPayment state. Please refer to the 'workaround' section for an example implementation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @vendure/core.
