SB2026110944 - Multiple vulnerabilities in Pay

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to create, modify, or cancel subscription and transaction records in Pay applications.

The vulnerability exists due to the Paddle Billing controller converting a missing signing secret into an empty HMAC key when the Paddle integration is enabled and neither PADDLE_BILLING_SIGNING_SECRET nor Rails credentials provide the secret. An unauthenticated remote attacker can submit webhook events signed with this empty key to /pay/webhooks/paddle_billing, bypassing signature verification and injecting forged events into billing processing.

2) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to forge Lemon Squeezy webhook events and create fake subscription and order records in Pay applications.

The vulnerability exists due to Pay's Lemon Squeezy webhook controller using an empty HMAC key when the signing secret is absent from environment configuration and Rails credentials. An unauthenticated remote attacker can submit events signed with that key to /pay/webhooks/lemon_squeezy when the lemonsqueezy gem is installed, bypassing signature verification.

Remediation

Install update from vendor's website.

References

• https://github.com/pay-rails/pay/security/advisories/GHSA-5p37-w3f3-55pm
• https://github.com/pay-rails/pay/security/advisories/GHSA-6mr3-672j-v5hf