Security isn’t something we treat as optional. Our team keeps a close eye on the Sylius ecosystem, takes every report from the community seriously, and turns fixes around as quickly as we responsibly can. In that spirit, today we’re shipping security fixes for PayPalPlugin versions 1.7 and 2.0. If your project relies on this package, please plan an upgrade soon, and pass the word along to others so the whole Sylius community stays protected.

PayPalPlugin 1.7 and above

Is my store affected by this vulnerability?

This issue exists in all PayPalPlugin versions before 1.7.9, and 2.0.11.

Description

The PayPal refund webhook endpoint did not verify that incoming requests actually originated from PayPal. Because the endpoint is intentionally public and the request payload was trusted, an unauthenticated attacker could send a crafted refund webhook whose body pointed to a server under their control. While processing it, the plugin attached the store’s PayPal access token as an Authorization: Bearer credential to an outbound request sent to that attacker-controlled URL, leaking the token and allowing server-side request forgery.The same unverified request can also drive the store to issue a real PayPal refund without authorization, which can translate into direct financial losses for the merchant.

Impact

• An unauthenticated attacker could obtain the store’s PayPal access token.
• With that token, the attacker can act against the PayPal REST API on the merchant’s behalf (e.g. inspect transactions, issue or manipulate refunds) for as long as the token is valid.
• The server could be induced to send authenticated requests to arbitrary attacker-chosen URLs (SSRF).
• An attacker could also trigger a genuine refund against a completed payment. The forged webhook drives the plugin to call PayPal’s refund API with the merchant’s own credentials, so the captured funds are returned to the payer without any legitimate authorization, causing a direct financial loss to the merchant.

Patches

The issue is fixed in versions 1.7.9, 2.0.11, and above.

Workarounds

If an immediate upgrade is not possible, merchants should take the following actions to mitigate risk:

• Disable PayPal: to prevent token exposure, merchants should immediately disable the PayPal payment method in their shops, or restrict the refund webhook endpoint (/paypal-webhook/api/) at the reverse proxy/firewall level so it is only reachable from PayPal’s published webhook source ranges.
• Schedule an upgrade or a workaround implementation: merchants should coordinate with their development teams to upgrade to a patched version of the PayPalPlugin (1.7.9, or 2.0.11) as soon as possible, or to have the workaround described in the security advisory implemented.

Keeping your store secure is crucial, please update your plugin and inform your peers in the Sylius community about this fix to ensure a safer environment for all.