An attacker exploiting this vulnerability can present fraudulent certificates to the application, effectively impersonating the payment provider. This enables the theft of sensitive merchant credentials, digital signatures, and transactional data. Furthermore, the attacker can manipulate the content of payment, refund, or order query responses, potentially leading to unauthorized financial operations or data integrity compromises. Defenders should prioritize updating to version 1.5.119 or later to enforce proper TLS validation.

Impact

Successful exploitation of this vulnerability allows for unauthorized access to sensitive financial information, including merchant credentials and transaction data. An attacker can manipulate payment flows, potentially resulting in fraudulent transactions or incorrect refund processing. This flaw impacts any merchant application relying on the affected gopay library for payment integration, with the severity of potential damage proportional to the volume and criticality of transactions processed by the compromised system.

Recommendation

• Upgrade the gopay dependency in all projects to version 1.5.119 or later to ensure TLS certificate verification is re-enabled.
• Audit application code for dependencies utilizing the affected defaultClient() function and ensure they are patched.
• Monitor network traffic for anomalous outbound connections from application servers to unknown or self-signed payment provider endpoints.