CVE-2020-23533 : Security Advisory and Response

Union Pay up to 1.2.0 contains a CWE-347 vulnerability that allows attackers to shop for free in merchants' websites and mobile apps.

Understanding CVE-2020-23533

Union Pay up to version 1.2.0 is affected by a critical vulnerability that enables attackers to exploit a cryptographic signature verification flaw.

What is CVE-2020-23533?

The vulnerability in Union Pay up to version 1.2.0 allows attackers to generate a crafted authentication code (MAC) based on a NULL secret key, enabling them to shop for free on merchants' websites and mobile apps.

The Impact of CVE-2020-23533

This vulnerability poses a significant risk to merchants using Union Pay, potentially leading to financial losses and reputational damage due to unauthorized free shopping activities.

Technical Details of CVE-2020-23533

Union Pay up to version 1.2.0 is susceptible to a CWE-347 vulnerability.

Vulnerability Description

The vulnerability involves improper verification of cryptographic signatures, allowing attackers to exploit the flaw and generate authentication codes with a NULL secret key.

Affected Systems and Versions

Product: Union Pay
Vendor: N/A
Versions affected: Up to 1.2.0

Exploitation Mechanism

Attackers can exploit the vulnerability by crafting authentication codes (MAC) based on a secret key that is NULL, enabling them to conduct free shopping on merchants' websites and mobile apps.

Mitigation and Prevention

It is crucial to take immediate steps to address and prevent the exploitation of CVE-2020-23533.

Immediate Steps to Take

Update Union Pay to the latest version that includes a patch for the CWE-347 vulnerability.
Monitor transactions for any suspicious or unauthorized activities.
Implement multi-factor authentication to enhance security.

Long-Term Security Practices

Regularly conduct security assessments and penetration testing to identify and address vulnerabilities.
Educate employees and customers about safe online practices and the importance of secure transactions.

Patching and Updates

Stay informed about security updates and patches released by Union Pay.
Promptly apply patches to ensure that systems are protected against known vulnerabilities.