gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Potential Mitigations
Related Attack Patterns
References
- https://github.com/go-pay/gopay
- https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37
- https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd
- https://github.com/go-pay/gopay/issues/540
- https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client