ST
FILE PATH
SHA256
TYPE
STATUS
AUTH & ACCESS CONTROL (IDOR / ATO)
R0-P0-01 · R0-P0-03
Account Takeover & Cross-Tenant VA Leak
TRANSACTION INTEGRITY & LEDGER
R0-P0-04 · R0-P1-07
Double Payout on Retry & VietQR Tag 59 Spoof
SUPPLY CHAIN & CREDENTIALS
R0-P0-05 · R0-P1-03 · B0
Unsigned OTA Bundles · Keystore · GitHub PAT
GATEWAY & BFF BOUNDARY
R0-PGW-H8 · R0-P1-04
Unauthenticated SSRF · NAT Loopback · Magic UUID
| ID | CODE | DOMAIN | FILE PATH & LINE | RULE ID | SEVERITY | STATUS |
|---|
| SERVICE PAIR | DETECTED CODE / CONFIG DRIFT | SEVERITY |
|---|---|---|
| ext-gateway-service ↔ ext-gateway-app-service | `VerifyTenantService.java:453` contains hardcoded bypass `d5b0e905-18a1-446c-bc41-c3667681594a`; `AuthFilter.java:67` comments out `checkRateLimit()`. | HIGH (R0-P1-04) |
| auth-service ↔ auth-app-service | `UserService.setupPassword:612` reads target account from `body.getUsername()` instead of `verifiedKey` owner; `merchant-super-auth` hashes email instead of username. | CRITICAL (R0-P0-01) |
| merchant-miniapps-uat ↔ merchant-miniapps-prod | Production CDN (`v1.0.2`) serves 2,723 unsigned `.bundle` files and returns HTTP 404 on `/manifest.bundle`, bypassing RS256 OTA verification. | CRITICAL (R0-P0-05) |
AWS SINGAPORE (`ap-southeast-1` — Current Prod)
• VPC: `10.121.0.0/16` (Prod) & `10.21.0.0/16` (Mgmt)
• EKS: `paypay-cluster` (11 nodes) & `prod-usdt-cluster` (9 nodes)
• EC2 Fleet: 35 VMs
• Legacy SFTP: `10.121.0.60` · Outbound Squid Proxy: `10.121.1.18:3128`
• EKS: `paypay-cluster` (11 nodes) & `prod-usdt-cluster` (9 nodes)
• EC2 Fleet: 35 VMs
• Legacy SFTP: `10.121.0.60` · Outbound Squid Proxy: `10.121.1.18:3128`
AWS MALAYSIA (`ap-southeast-5` — New Prod Cluster)
• VPC: `10.0.0.0/16` (`paypay-prod-vpc`) · NAT GWs: `56.68.40.252`, `43.217.21.135`
• EKS: `paypay-prod-eks` (8 nodes: 4 app, 4 infra) + 3 MPC nodes (`mpcium-01..03`)
• Build Server: `i-069a8db4684cc2118` (`/home/ssm-user/workspace/` — 42 repos)
• Malaysia SFTP: `10.0.1.232` · 10 CloudFront Distributions in front of `paypay-alb-public`
• EKS: `paypay-prod-eks` (8 nodes: 4 app, 4 infra) + 3 MPC nodes (`mpcium-01..03`)
• Build Server: `i-069a8db4684cc2118` (`/home/ssm-user/workspace/` — 42 repos)
• Malaysia SFTP: `10.0.1.232` · 10 CloudFront Distributions in front of `paypay-alb-public`
| CIDR / IP ADDRESS | IDENTIFIED OWNER / ENTITY | SECURITY GROUP / TARGET | OPEN PORTS / PROTOCOL | AUDIT ACTION |
|---|
| TIMESTAMP (UTC) | TIMESTAMP (ICT GMT+7) | SCOPE | EVENT SUMMARY |
|---|
VERIFIED INFRASTRUCTURE CHECKS:
• `/etc/ld.so.preload` Integrity: CLEAN• Unauthorized Tunnel / Miner Processes (`npc`, `frp`, `chisel`, `xmrig`, `COS`): 0 RUNNING
• C2 Egress Blocklist (`206.238.68.119`, `206.238.123.78`): 0 CONNECTIONS
• Authorized Cloudflare Tunnels (`91e54bf4...` & `686a7e1b...`): VERIFIED
• MPC Key Backup Permissions (`/opt/mpcium_backup_*`): ENFORCE CHMOD 0600
• Exposed GitHub PAT (`config-server-service` commit `3437ec2`): REVOKE REQUIRED (B0)
RELEASE GATE STATUS (`release/v3.0.0`)
NO-GO · 5 CRITICAL BLOCKERS
All credentials masked with HMAC-SHA256 fingerprints