T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- server-simple.ts:1143
- Finding
- HOT PAY Webhook Events Are Accepted Without Authentication<![CDATA[ ## Vulnerability Details **File Location**: `server-simple.ts:1143-1162` **Vulnerability Type**: Unauthenticated webhook processing **Risk Level**: High ### Vulnerable Code ```typescript // HOT PAY Webhook endpoint app.post('/webhook/hotpay', (req, res) => { try { const payload = req.body; console.log('\n🔔 HOT PAY Webhook Received'); console.log('='.repeat(70)); console.log(JSON.stringify(payload, null, 2)); console.log('='.repeat(70)); if (payload.type === 'PAYMENT_STATUS_UPDATE' && payload.status === 'SUCCESS') { console.log(`✅ Payment Confirmed!`); console.log(` Item ID: ${payload.item_id}`); console.log(` Amount: $${payload.amount_float} (${payload.amount_usd} USD)`); console.log(` Memo: ${payload.memo || 'N/A'}`); console.log(` TX Hash: ${payload.near_trx}`); console.log(` Verify: https://nearblocks.io/txns/${payload.near_trx}`); } res.status(200).json({ received: true }); } catch (error: any) { console.error('❌ Webhook Error:', error.message); res.status(500).json({ error: 'Webhook processing failed' }); } }); ``` ### Technical Analysis The webhook endpoint trusts arbitrary JSON without verifying a provider signature, shared secret, timestamp, event identifier, transaction status, or replay state. Any party that can access the public tunnel can submit an object containing `type: "PAYMENT_STATUS_UPDATE"` and `status: "SUCCESS"`, causing it to be treated as a confirmed payment. This contradicts the webhook signature-verification claim in `SKILL.md:290`. Although the current handler primarily logs the event, it establishes an unsafe payment-confirmation boundary and would become directly exploitable for unauthorized fulfillment if business logic were subsequently attached. ### Attack Path 1. The operator starts the Skill and exposes it through the localhost.run tunnel. 2. An attacker obtains or guesses the public tunnel URL. 3. The ...[truncated 846 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Verify HOT PAY signatures over the unmodified raw request body using a dedicated webhook secret. - Reject requests with missing, malformed, or invalid signatures before parsing or processing event fields. - Validate signed timestamps within a narrow tolerance to prevent delayed replay. - Persist unique event or transaction identifiers and reject duplicates. - Verify payment status and transaction details independently against the provider or blockchain before fulfillment. - Compare the item ID, amount, token, recipient, and transaction hash against an expected local payment record. - Update the documentation so signature-verification claims accurately reflect the implementation. ]]>