HikaShop 6.6.0 fixes a high severity vulnerability in the Bambora (Beanstream) payment plugin shipped with HikaShop, reported to us through the Joomla security team. On the shops concerned, someone who knew the id of an order could have that order marked as paid without any payment having been made.
Here is what the issue was, how to know whether your shop is concerned, and what to do.
The issue
The Bambora (Beanstream) payment plugin offered three choices in its "Hash method" setting: None, MD5 and SHA1. The hash is what proves that a payment notification really comes from Bambora, and the check was only made when the setting was MD5 or SHA1. With the setting on None, the notification was accepted on three of its own fields alone, which anyone can send, and the order moved to the status configured for a verified payment. The amount announced by the notification was not compared with the total of the order either, so a notification claiming to pay one cent for an order of a thousand confirmed it all the same.
Are you concerned?
Only if your shop takes payments through Bambora (Beanstream) and the "Hash method" of that payment method is set to "None".
The plugin is shipped with HikaShop but it does nothing until you create a payment method with it, so a shop which does not use Bambora was never exposed, whatever version it runs. A Bambora payment method configured with MD5 or SHA1, which is what our documentation recommends and what most shops have, was not exposed either: those notifications were already being checked.
To find out, go to System > Payment methods in your back-end, open your Bambora (Beanstream) method, and look at its "Hash method" setting.
Affected versions: all editions of HikaShop (Starter, Essential and Business), from the earliest versions up to and including 6.5.2. The issue is fixed in 6.6.0.
What we changed
The "None" choice is removed from the setting, and the plugin now refuses what it cannot check rather than trusting it. A payment method without a hash method and a hash key can no longer send a customer to Bambora, and a notification arriving for such a method is refused and written to the log of the plugin instead of confirming anything. The amount announced by the notification is now compared with the total of the order as well, on every hash method, and a notification announcing a different amount puts the order in your invalid status instead of the verified one.
If your payment method was set to "None", open it after the update and select the hash method your Bambora account is configured with, as its notifications are refused until you do.
Update recommended
Because this fix concerns security, we advise the merchants using Bambora to update to HikaShop 6.6.0 as soon as possible, using the one click updater in your back-end or the package from your member area. The merchants who do not use that payment plugin are not exposed and can update at their usual pace.
If you cannot update right away
This one can be closed from your back-end alone, with no file to edit. On your Bambora account, in administration > account > order settings, turn on the hash validation and generate a hash key, then in HikaShop open your Bambora payment method, set its "Hash method" to the algorithm you chose there and copy the key into its "Hash" field. From that moment the plugin checks every notification it receives, on any version of HikaShop.
If you do not use that payment method at all, you can also simply unpublish it, or turn the "Bambora (Beanstream)" plugin off in your Joomla plugin manager.
Reporting a security issue
If you believe you have found a security issue in HikaShop, please tell us through our contact form rather than on the forum, so that it can be fixed before it is described publicly. Our thanks go to the Joomla security team for handling this report with us.
