GHSA-8f7v-xf7j-hc3q: 
PHP vulnerability analysis and mitigation

Identifiers passed to SDK methods are interpolated into API request paths without encoding. An identifier that comes from an end user can change the request path, for example ../../v1/payouts-account/balance or 123/../../v1/payouts, so the SDK sends a request carrying the merchant's x-client-id/x-api-key to a different payOS API endpoint. For cancel methods that request is a POST with the SDK's body.

Affected versions

Severity

Moderate — CVSS 3.1 base score 4.8, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-23 (Relative Path Traversal), CWE-116 (Improper Encoding or Escaping of Output).

Details

Affected methods:

• paymentRequests->get/cancel, invoices->get/download, payouts->get, and the legacy getPaymentLinkInformation/cancelPaymentLink Precondition: the merchant application passes an identifier it received from an end user (for example an order code from a return URL) to one of these methods without validating it.

Fix

Identifiers are percent-encoded as a single path segment. Empty values, . and .., negative numbers and integers above 2^53-1 are rejected before any request is sent.

Workarounds

Until upgrading, validate identifiers before passing them to the SDK: accept only the expected format (for example digits for order codes and [A-Za-z0-9_-] for payment-link and payout ids).

Credits

Found by the payOS security team.