Description

Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-02T13:18:11.653Z",
  "pubdate": "2026-09-02T13:18:11.653Z",
  "executiveSummary": "The Drupal Commerce CyberSource module is susceptible to an observable timing discrepancy vulnerability, which exposes the system to brute-force attacks.\nThis vulnerability is categorized as a side-channel attack where the time taken to process requests—specifically during authentication or validation operations—varies based on the validity of the input.\nThe issue impacts Commerce CyberSource versions ranging from 0.0.0 through 1.10.0.\nBy measuring minute differences in response latency, an unauthenticated attacker can infer valid credentials or sensitive system states, effectively bypassing traditional rate limiting or lockout protections.\nThe risk implication is significant as it facilitates automated credential stuffing or brute-force enumeration, potentially leading to unauthorized access to payment transaction interfaces.\nExploitation requires no elevated privileges but relies on the ability of the attacker to perform network-level timing measurements against the server hosting the Drupal instance.",
  "technicalDetails": "The vulnerability originates from non-constant time comparison operations within the Commerce CyberSource request validation logic. In cryptographic and authentication implementations, comparisons between user-provided input and expected values must be performed in constant time to prevent side-channel analysis.\nIn the affected versions (0.0.0 to 1.10.0), the application utilizes standard string comparison functions that return as soon as a mismatch is detected. Because the processing time is proportional to the number of matching characters, an attacker can determine the correctness of a sequence by observing response latency patterns.\nThe attack flow begins with the adversary sending a series of specifically crafted requests to the CyberSource payment integration endpoint. By capturing the round-trip time (RTT) for each request with high precision—often requiring numerous samples to filter out network jitter—the attacker can distinguish the time difference between an invalid request and one that partially matches a legitimate internal key or token.\nOnce a partial match is confirmed, the attacker iteratively brute-forces subsequent positions until the full sequence is recovered. This reduces the complexity of the brute-force search space from exponential to linear, enabling the successful compromise of secrets that would otherwise be computationally infeasible to crack within a reasonable timeframe.\nThis vulnerability is particularly critical in payment processing modules, as it may allow an attacker to forge requests, validate fake payment confirmations, or intercept sensitive API interactions. Because the issue resides in the core processing logic of the module, it is exposed to any network-accessible endpoint that triggers the vulnerable comparison routine.\nThe exploitation does not require prior authentication, as the timing leak occurs during the initial validation phases of the CyberSource communication handshake. Post-exploitation, an attacker could maintain persistent access to the module's administrative functions or manipulate payment states, leading to financial fraud or data exfiltration."
}