[Security] Public callback logs in as Administrator and processes untrusted payment payload

[chromonav]

Branch

• dev

Evidence

• easebuzz/www/easebuzz/success.py#L6-L10

if frappe.session.user == "Guest":
    frappe.local.login_manager.login_as("Administrator")
    data = frappe.form_dict
    frappe.get_last_doc("Easebuzz Settings").handle_response(data)
    frappe.local.login_manager.login_as("Guest")

Problem

The public success endpoint elevates a guest request to Administrator and processes request payload from frappe.form_dict. This creates a privilege-escalation path for unauthenticated traffic.

Risk/Impact

• Any internet caller can hit /easebuzz/success with crafted query/body values.
• Business action (on_payment_authorized) is executed in an elevated session.
• Compromise impact is high because payment state transitions happen with admin authority.

Replication suggestion

1. Create a Payment Request in a test site.
2. As an unauthenticated user, call /easebuzz/success with crafted udf1, udf2, status=success, txnid.
3. Observe that the flow enters login_as("Administrator") and invokes handle_response.
4. Verify whether payment status/transaction fields changed without authenticated operator action.

Expected: guest callback should never escalate privileges.
Actual: code escalates to Administrator and performs payment-side effects.

Resolution suggestion

• Remove login_as("Administrator") from web callback handling.
• Move callback processing to a dedicated whitelisted method that validates gateway signature/hash before any document mutation.
• Enforce least privilege: use explicit permission checks or a controlled server-side integration user context, not global admin login.
• Return safe HTTP responses (200/400) instead of silently swallowing exceptions.

Acceptance criteria

• No callback code path performs login_as("Administrator").
• Callback rejects invalid/unsigned payloads.
• Payment mutation occurs only after successful cryptographic verification.
• Automated test covers unauthenticated callback attempt and ensures no state transition.