CVE-2020-36284
📋 TL;DR
This vulnerability in Union Pay Android apps allows attackers to bypass payment authentication by generating fraudulent cryptographic signatures using a NULL secret key. Attackers can make purchases without paying on merchant websites and mobile apps. Affected users are those running vulnerable Union Pay Android applications.
💻 Affected Systems
- Union Pay Android applications
📦 What is this software?
Union Pay by Unionpayintl
⚠️ Risk & Real-World Impact
Worst Case
Attackers can make unlimited fraudulent purchases without payment, causing significant financial losses to merchants and payment processors.
Likely Case
Targeted attacks against specific merchants to obtain goods/services without payment, potentially leading to financial fraud.
If Mitigated
With proper signature verification and non-NULL secret keys, all fraudulent transactions would be rejected.
🎯 Exploit Status
Proof-of-concept code is publicly available, making exploitation straightforward for attackers with basic technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.4.93.4.9
Vendor Advisory: http://mobitec.ie.cuhk.edu.hk/cve_2020/
Restart Required: Yes
Instructions:
1. Update Union Pay Android SDK to latest version. 2. Update all merchant apps using Union Pay integration. 3. Restart applications after update.
🔧 Temporary Workarounds
Disable vulnerable Union Pay integration
androidTemporarily disable Union Pay payment option in merchant apps until patched.
🧯 If You Can't Patch
- Implement additional server-side transaction verification
- Monitor for suspicious payment patterns and implement transaction limits
🔍 How to Verify
Check if Vulnerable:
Check Union Pay SDK version in Android app; if version ≤ 3.4.93.4.9, app is vulnerable.Check Version:
Check Android app manifest or build.gradle for Union Pay SDK versionVerify Fix Applied:
Verify Union Pay SDK version is > 3.4.93.4.9 and test payment authentication with invalid signatures.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful transactions
- Transactions with unusual MAC values
Network Indicators:
- Payment requests with NULL or empty cryptographic signatures
- Unusual payment patterns from single users
SIEM Query:
payment_auth_failure AND payment_success WITHIN 5min🔗 References
- http://mobitec.ie.cuhk.edu.hk/cve_2020/
- https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0
- https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0
- http://mobitec.ie.cuhk.edu.hk/cve_2020/
- https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0
- https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0
