Threats affecting pkg:cpan/Business-GoCardless

Business-GoCardless versions before 1.01 for Perl contain an authorization bypass vulnerability where the redirect flow ID is not properly validated against the user session. This allows an attacker who obtains another customer's redirect flow ID to create payments or subscriptions against that customer's mandate without authorization. The flaw exists because the confirm_resource function does not verify the session token and completes redirect flows solely based on the redirect flow ID returned by the GoCardless API. The issue was fixed in version 1.01.

Business-GoCardless versions before 1.01 for Perl improperly verify cryptographic signatures on webhooks when the configured webhook secret is undefined or empty. This allows an attacker to forge webhooks by signing them with an empty key, which the system accepts as valid. The issue arises because the signature validation function does not reject empty or undefined secrets, which Digest::SHA treats as an empty key.

Business-GoCardless versions before 1.01 for Perl contain a vulnerability that allows remote attackers to exhaust memory by sending specially crafted webhook payloads. The flaw arises because legacy webhook payloads are flattened into key-value pairs without limits or throttling before signature verification, causing memory usage proportional to the payload size. This can lead to denial of service via memory exhaustion.