GHSA-r9v2-gg2j-22q5: Npm/@payloadcms/plugin-stripe vulnerability
Impact
An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.
You are affected if ALL of these are true:
- Your application uses @payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled. - An authenticated user can reach the proxy.
Deployments that do not enable the Stripe REST proxy are not affected.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended.
If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@payloadcms/plugin-stripeto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Upgrade
Upgrade
npm/@payloadcms/plugin-stripeto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 3.90.0 - Upgrade
Upgrade
Payload packagesto a version that resolves this vulnerability.Fixed in 4.0.0-canary.34 - Configuration
Disable the optional Stripe REST proxy if you cannot upgrade immediately.
optional Stripe REST proxy enabled = false - Compensating control
If the optional Stripe REST proxy remains enabled, restrict access to trusted users and permit only the required Stripe operations.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
A deployment is affected only when it uses @payloadcms/plugin-stripe, has enabled the optional Stripe REST proxy, and allows an authenticated user to reach that proxy. Deployments with the Stripe REST proxy disabled are not affected.
What access does an attacker need?
The attacker must be an authenticated user who can reach the Stripe REST proxy. The issue can allow that user to perform unintended Stripe operations through the proxy.
What can be done before upgrading?
Disable the Stripe REST proxy if an immediate upgrade is not possible. If it must stay enabled, limit access to trusted users and permit only the Stripe operations that are required.
Which versions contain the fix?
Upgrade Payload packages to version 3.90.0 or later, or to 4.0.0-canary.34 or later.