Funnel Builder Flaw Under Active Exploitation Enables WooCommerce Checkout Skimming

"The flaw lets unauthenticated attackers inject arbitrary JavaScript into every checkout page on the store, the Dutch e-commerce security company said. FunnelKit, which maintains Funnel Builder, has released a patch for the vulnerability in version 3.15.0.3. The vulnerability currently does not have an official CVE identifier. It affects all versions of the plugin before 3.15.0.3. It's used in more than 40,000 WooCommerce stores."

"“Attackers are planting fake Google Tag Manager scripts into the plugin's 'External Scripts' setting,” it noted. “The injected code looks like ordinary analytics next to the store's real tags, but loads a payment skimmer that steals credit card numbers, CVVs, and billing addresses from checkout.”"

"Per Sansec, Funnel Builder includes a publicly exposed checkout endpoint that allows an incoming request to choose the type of internal method to run. However, older versions were designed such that they never checked the caller's permissions or limited which methods are allowed to be invoked. A bad actor could exploit this loophole by issuing an unauthenticated request that can reach an unspecified internal method that writes attacker-controlled data directly into the plugin's global settings."

"The added code snippet is then injected into every Funnel Builder checkout page. As a result, an attacker could plant a malicious <script> tag that's triggered on every checkout transaction in a susceptible WordPress site. In at least one case, Sansec said it observed a payload masquerading as a Google Tag Manager (GTM) loader to launch JavaScript hosted on a remote domain."

A security vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout pages. The flaw affects all plugin versions before 3.15.0.3 and impacts more than 40,000 WooCommerce stores. It allows unauthenticated attackers to inject arbitrary JavaScript into every checkout page. Attackers plant fake Google Tag Manager scripts into the plugin’s “External Scripts” setting, where the injected code appears to be legitimate analytics but loads a payment skimmer. The skimmer steals credit card numbers, CVVs, and billing addresses during checkout. The issue stems from a publicly exposed checkout endpoint that can invoke internal methods without proper permission checks or method restrictions, enabling attacker-controlled data to be written into global plugin settings and then injected into checkout pages.

Read at The Hacker News