Software Engineering Institute

NETELLER Direct Payment API version 4.1.6 was reported to be vulnerable to parameter manipulation through a modified HTTP POST request and URL redirection, which would allow a malicious user to purchase items without paying the merchant for them. After further analysis and discussion with NETELLER, the initial report was found to be incorrect. NETELLER Direct Payment API is not vulnerable to this attack.

During a NETELLER Direct Payment API purchase transaction, the purchaser provides their NETELLER account number and PIN to the merchant, who then communicates with NETELLER to complete the transaction. The merchant could use the account number and PIN to make fraudulent transactions against the purchaser's account. Presumably, fraudulent transactions would be noticed by the purchaser and subject to investigation and possible termination of the merchant's account by NETELLER.

This reported vulnerability would have been an example of CWE-602: Client-Side Enforcement of Server-Side Security.

CVE-2013-3611 was originally assigned to this vulnerability.

As with most, if not all electronic payment systems, the purchaser needs to trust other parties with sensitive account and identity information. In this case, the merchant may be able to make fraudulent purchases against the purchaser's NETELLER account.

NETELLER recommends following the Direct Payment API Integration documentation.