WorldPay Module for ZenCartv1.3x

Good Evening.

The second exploit is live and out there too, and is different from the first. Alan will be addressing it in the next version BUT there is a workaround for the second one.

The current advice is to either disable worldpay or to check for the confirmation emails or check the account. AfterHour should be able to confirm, that I have ordered about £80 of items from his shop but only paid 1 pence for the goods, he also received a confirmation email from WordPay that if he did not read carefully, he would have thought the transaction was fully paid up. It would only be spotted in careful reading and going to the worldpay account.

The current advice for anyone with worldpay installed is to carefully check your worldpay account by logging on and confirming the amount paid corresponds to what zencart is telling you. The workaround for the second exploit it to use MD5. These instructions have been provided for me by Carl Stone, who has been helping my research by allowing me to run test transactions through his server. Note at all times I have never been able to access the admin section, nor do I require administrative passwords, this is a critical exploit as it can be done on any zencart with worldpay. The advice for turning on MD5 is as follows:

Ok, in the worldpay system settings you go to integration setup (you have to go to "production" first), then set your password in "MD5 secret for transactions" and save. You then switch to Test and do the same making sure you save after each change. [ this section in italics may only be if you are using the test mode as well as production, I believe - Philip ]

In Alan's module the is an MD5 field where you add the same password, you also have to set MD5 to True in another field.

Thank you Carl - aka snow-man
Thank you AfterHour - sorry I had to demo it on your server again but I had to make sure it was in the wild and that it wasn't anything I had introduced while working through the module with Carl.

I'm sorry but I had to do this, blame my sense of humour and Duncanad's Signature. I'll tell you about the penguins, bear in mind they are almost 10 years old and the code even works in Google Chrome without modfication since it was originally written in Javascript. You can check this on the internet archive, they used to be on bouncing.org's front page (the way back machine appears to be overloaded for most of today).

exploitingIT.co.uk, exploiting IT for Business
also exploitingIT.com for America and exploitingIT for YOU

Hm ... I don't think this is very special for WorldPay alone, it applies to most of the payment gateways because of the way Zen Cart, osC etc. works in this area. Arrest me if I'm wrong ... but MD5 should be used on all, if available, in order to avoid this behaviour. This is nothing new, we've seen it before on other modules.

Btw! This is also why some payment providers don't allow instant capture as default, because you should check all payments before shipping.

Just my 2 cents.

Morning,

I've tried it with the paypal IPN_Handler. That's very well written, and it won't pay for the items if the amount/ currency id different. It also throws an error if you have debug mode set and one tries the first exploit, which states

IPN WARNING :: Transaction was not marked as VERIFIED. Keep this report for
potential use in fraud investigations.
IPN Info = 
INVALID

That would be email number 6 in debug mode, on a live site. After the ipn_main_handler.php receives a post, it posts the information back to paypal for more confirmation, so if the transaction never took place, if the currency is wrong, if the amount is different then the PayPal server throws an INVALID response.

I started testing other modules for similar exploits yesterday.

Thanks

I'll add to that comment above.

It's not complex to only mark a shopping cat as paid, if the amount and currency match.

MD5 or not, the first exploit worked, and any shopping cart could be marked as paid.

The second expoilt means that a £100 cart can be marked as paid up for 1 pence. Some people do not read their notification emals correctly, but as I was saying to Alan. A nice way to carry on fraud is to find things you like and then take a 10-20% discount off them, then free shipping. If caught one's defence is "how the friggin hell do I know why they gave me a discount", it's very difficult to prove in a court of law especially since the amount paid and authrosied is directly coming from paypal/ worldpay and they almost certainly have a contract with you stating that it's up to you to have used every available method to provide them with the correct payment amount.

Thanks
Philip.

PayPal is not the same type of payment gateway as WorldPay, DIBS etc., just so we know that. ;)

I haven't really investigated worldpay (as in going there and finding out how it works) as yet, the system is good if the module is implemented correctly, I do have to have a look at the documentation at some time to check for a few other things. I think that the next version of the module should be secure, myself and Alan have already gone over it for XSS possibilities and the "next" module itself is currently secure, whether ZC is secure against them further down the chain is another matter.

I'll be looking at how OsCommerce handles things too, but this is unpaid so it'll be when I can squeeze it in.

I have got your e-mails Philip, apologies for not replying sooner but I have been trying to spend more time with the kids this weekend :) I will get my fine tooth comb out for the morning...

I can confirm from a previous post of Philps, that it is possible to use the second exploit for worldpay to return a confirmation e-mail, that payment has been received and if you have lots of orders coming in (I wish!!) it could be quite easy to miss, that all was not well.

Thanks for all the time and effort to resolve this Philip and you too Alan... keep up the good work :)

Forever a Cynic.....
AfterHouR

Thank you Afterhour, I understand that some people have family commitments, I'm just a little too obssessive, although in the current fashionable words of the day, I suppose I could pass it off as being "passionate" about my work.

Alan can handle everything, I am going to shift my focus on some other things that have cropped up during this investigation, like how to set up a system within zencart to store "critical exploit alerts", it'll be a useful use of my time. I'll have to persuade the zencart developers, and the module developers to implement a simple version listing file in their systems and then a comparison and since I'm as subtle as an axe, it may be sometime before the system is implemented, but if you think about it, during this pretty serious alert, there's only been about 5 visitors to the thread, and I'm damned sure that there's a lot more installations around than that.

SECURITY PATCH AVAILABLE FOR DOWNLOAD

You will find below a link to dowload a Patch to address the Security Exploits discussed above. Thanks to Philip Clarke for identifying these and for his assistance in testing this patch. He has also made some further suggestions which I will try to absorb and incorporate in future releases as appropriate.

THIS PATCH IS FOR THE FOLLOWING VERSION OF THE WORLDPAY MODULE:

WorldPay_ZC1.3x_v1.0_beta

This version was not available from the Downloads but from my website - a link has been posted on the forums at least twice previously. It's beta because I was not able to test this on PHP5. Philip has posted above details of how to configure the host server to allow the module to work on PHP5.

IF YOU ARE USING THE VERSION FROM THE DOWNLOADS SECTION UPGRADE TO THIS VERSION FIRST AND THEN APPLY THE PATCH IMMEDIATELY

When upgrading follow the installation instructions carefully. You will need to remove all the previous version files from your server. Also it will only work on 1.3x versions of Zen Cart so if you are still using an earlier version of Zen Cart upgrade your Zen Cart first.

The two exploits are as follows:

1. The existing module can be fooled into processing an order without a payment having gone through WorldPay. This is fixed by setting a Payment Response Password. The patch adds functionality to process the Payment Response Password.

2. The order value processed by WorldPay can be altered so that the customer pays less than the order value. This is fixed by configuring the existing MD5 functionality which has always been available within the module.

Both of these exploits will only be successful if shop owners are not vigilant in checking orders against WorldPay payments.

The download links are as follows:

WorldPay_ZC1.3x_v1.0_beta

http://www.workingit.co.uk/ZenCart/WorldPay/WorldPay_ZC1.3x_v1.0_beta.zip

WorldPay_ZC1.3x_v1.0_beta_security_fix

http://www.workingit.co.uk/ZenCart/WorldPay/WorldPay_ZC1.3x_v1.0_beta_security_fix.zip

I will submit a new version, including the security patch, to the downloads section asap.

Regards,

Alan

Thanks again for all your hard work Duncan and Philip and for getting onto this straight away..

It is a real shame there hasn't been more of an uptake to this, I expected more of a response on these pages from people than this... Ignorance is bliss, or is it ignorance is no defence???

Anywho...

Can I make a small suggestion to your documentation Duncan

the dashboard in Worldpay has changed slightly and so has some of the wording...

5. Also in the Configuration Options set the following if not done already:

   Callback Enabled? - ensure this is ticked.
   Use callback response? - ensure this is ticked.
   Callback suspended? - ensure this is NOT ticked (it automatically selects if callback fails)
   Payment Response Password - enter your password. Make this secure using numbers and letters. You only have to remember it long enough to enter it in your Zen Cart Worldpay module configuration.
   MD5 secret for transactions - enter a pass phrase which can be up to 16 characters long and include spaces. You will need to contact WorldPay technical support first for this to be enabled.
   Note: You will find more information on how to configure your WorldPay installation here: http://www.worldpay.com/support/kb/mergedProjects/htmlredirect/rhtml.html

should read

5. Also in the Configuration Options in Worldpay installation set the following if not done already:

   Payment Response enabled? - ensure this is ticked.
   Enable Recurring Payment Response? - ensure this is ticked.
   Enable the Shopper Response? - ensure this is ticked
   Suspension of Payment Response? - ensure this is NOT ticked (it automatically selects if callback fails)
   Payment Response Password - enter your password. (and then again to validate, do not tick use default as it will reset password fields) Make this secure using numbers and letters. You only have to remember it long enough to enter it in your Zen Cart Worldpay module configuration.
   MD5 secret for transactions - enter a pass phrase which can be up to 16 characters long and include spaces. (and then again to validate, do not tick use default as it will reset password fields)
   Click on update installation (You don't have to contact WorldPay technical support anymore for MD5 as this is now done from Worldpay dashboard)

Note: You will find more information on how to configure your WorldPay installation here: http://www.worldpay.com/support/kb/mergedProjects/htmlredirect/rhtml.html

I hope that helps

Kind Regards
AfterHouR

Err... Spoke too soon :(

I'm getting an MD5 signature could not be verified error from Worldpay.. There is something in the following that Worldpay doesn't like and yes before anyone asks, I have verified that fat fingers are compatible with the keyboard and the MD5 in Worldpay dashboard and zen worldpay module are the same :) hehehe

function worldpay()
{
global $db, $order;
$this->code = 'worldpay';
$this->title = MODULE_PAYMENT_WORLDPAY_TEXT_TITLE;
$this->description = MODULE_PAYMENT_WORLDPAY_TEXT_DESCRIPTION;
$this->sort_order = MODULE_PAYMENT_WORLDPAY_SORT_ORDER;
$this->enabled = ((MODULE_PAYMENT_WORLDPAY_STATUS == 'True') ? true : false);
if ((INT)MODULE_PAYMENT_WORLDPAY_TEST_MODE !== 0)
{
$this->form_action_url = 'https://select-test.worldpay.com/wcc/purchase';
}
else
{
$this->form_action_url = 'https://select.worldpay.com/wcc/purchase';
}
if ((int)MODULE_PAYMENT_WORLDPAY_ORDER_STATUS_ID > 0)
{
$this->order_status = MODULE_PAYMENT_WORLDPAY_ORDER_STATUS_ID;
}

if (is_object($order)) $this->update_status();

}

Regards
AfterHouR

Sorry ignore the last post, 7 minutes had past before I could alter it.... should read

Err... Spoke too soon :(

I'm getting an MD5 signature could not be verified error from Worldpay.. There is something in the following that Worldpay doesn't like and yes before anyone asks, I have verified that fat fingers are compatible with the keyboard and the MD5 in Worldpay dashboard and zen worldpay module are the same :) hehehe

if (MODULE_PAYMENT_WORLDPAY_USEMD5 == 'True')
{
$md5_signature_fields = 'amount:lang:email';
$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ':'.$OrderAmt.':' . $language_code . ':' . $order->customer['email_address'];
$md5_signature_md5 = md5($md5_signature);

    $process_button_string .= zen_draw_hidden_field('signatureFields', $md5_signature_fields ) .
                              zen_draw_hidden_field('signature',$md5_signature_md5);
  }
    return $process_button_string ;
  }

Sorry, it's 20 years since I have done any real programming, apart from the odd script alterations over the last 12 months and I have had all sorts of learning curves and constant insomnia to cope with :) So some of my basic knowledge has been fried along the way...

So any help from you experts out there will be greatly appreciated...

Regards
AfterHouR

AfterHour - I am getting this error having followed the re-installation instructions and applying the patch.

Is there anyone else out there that can help? Alan?

Carl, I am around if you want me to have a look.

Philip.

Please try this

Line 186 that says (worldpay.php from the "fix")

$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ':'.$OrderAmt.':' . $language_code . ':' . $order->customer['email_address'];

try this

$md5_signature = MODULE_PAYMENT_WORLDPAY_MD5KEY . ':'.$OrderAmt.':' . $_SESSION['languages_code'] . ':' . $order->customer['email_address'];

and put a transaction through. It appears Alan has changed the currency language construction higher up in the worldpay.php file but not changed it lower down. :oops:

We also have some other potential bugs in worldpay.php depending on shop configuration.

line 142 and 143 in the worldpay.php "fix" states

$callback_url = zen_href_link(FILENAME_WP_CALLBACK, '', 'SSL');
$worldpay_callback = explode('https://', $callback_url);

and further down on line 181 we have this

zen_draw_hidden_field('MC_callback', $worldpay_callback[1]);

Now this is going to cause problems. Firstly, $worldpay_callback[1] does not work if one is has been forced to manually alter the script to not using SSL, One should have to do this. Really FOR EVERYONE NONSSL OR SSL, then line 143 should be

$repl = array('http://','https://');
$worldpay_callback = str_replace($repl,'', $callback_url);

and then line 181 should be replaced with

zen_draw_hidden_field('MC_callback', $worldpay_callback);

There are however still problems. Alan has omitted the $zenId variable that he had previously, so unless the cartId re-established the session in his code (I haven't checked as I have pointed out, I have no worldpay access and so must code using my imagination as to what could happen). then really line 142 should read

$callback_url = zen_href_link(FILENAME_WP_CALLBACK, zen_session_name() . '=' . zen_session_id(), 'SSL');

The above code does set up an SSL callback, but it's stripped out later and then you enter whether your callback is SSL or not when you enter the details into the worldpay admin interface (well that's what I've understood from the general installation instructions).

Thank you
Philip.

I'll correct myself too:

line 142 should probably read

$callback_url = zen_href_link(FILENAME_WP_CALLBACK, zen_session_name() . '=' . zen_session_id());

since the SSL is superflous as one apparently enters either http:// or https:// into the worldpay module anyway.

I have a rough replacement for the worldpay.php file that was in includes/modules/payment it is located here:

http://bouncing.org/worldpay.zip

it may not work as it's bee done in a rush this morning. It contains last night's modifications. Use at your own risk

There have been some errors with the beta of this module. On occasion Worldpay is not submitting the new secret password and so is being treated like a hacker :clap:

Some people will report a 302 error. Also slow servers on cheap hosts time out on the last page and so do not present the shop back to the shopper, they present a worldpay page, which apparently can be customised so I would suggest people put links on there's if possible back to their shop's front page if they are using a cheap host (I still have no access to worldpay, so I do not know how easy the customisation process is though I have seen people's logos when popping through the gateway during testing).

Things I would suggest for the development of this module. The idea that people have to edit their files depending on whether they use SSL or not is lunacy. In the includes/configure.php file there is this

// Use secure webserver for checkout procedure?
define('ENABLE_SSL', 'false');

so it is easy to work out whether the callback should be SSL enabled. You know, there are many more things that could be done to make this module easier to use and install, but it's 2am, it's not my module, and I'm going for a :smoke:.