CVE-2014-10067

Vulnerability

The PayPal IPN (Instant Payment Notification) library for Node.js, paypal-ipn versions before 3.0.0, trusts the test_ipn parameter sent by the PayPal IPN simulator to decide whether to verify the notification against PayPal's production or sandbox endpoint [1]. An attacker can include this parameter in a crafted IPN request, and if the application does not explicitly reject it in production, the library will use the sandbox endpoint for verification [1].

Exploitation

An attacker must craft a fake IPN notification request that includes the test_ipn parameter set to a truthy value. The request is sent to a vulnerable application's IPN handler. No authentication or special network position is required, as the IPN endpoint is typically public. The attacker can then use the PayPal sandbox environment to generate valid-looking but fraudulent payment notifications, which the application will accept because verification is performed against the sandbox [1].

Impact

Successful exploitation allows the attacker to trick the application into treating a fake payment as genuine. This can lead to unauthorized access to goods or services, account balance manipulation, or other financial fraud, as the application processes the notification as if it came from PayPal's production system [1].

Mitigation

Upgrade to paypal-ipn version 3.0.0 or later, where the library ignores the test_ipn parameter and always uses the production endpoint [1]. For users unable to upgrade immediately, the application must explicitly check for and reject any IPN request containing the test_ipn parameter. No workaround is provided by the library itself. The vulnerability is not listed in CISA KEV.