T09 · Insecure Skill Coding Practices
Error
- Location
scripts/webhook_server.py:20- Finding
Webhook Authentication Fails Open for Unsigned Requests
- Content
View full analysis
bool: """Verify HMAC-SHA256 signature from provider.""" if not secret: return True # Skip verification if no secret configured expected = hmac.new(secret.encode(), payload_bytes, hashlib.sha256).hexdigest() return hmac.compare_digest(f"sha256={expected}", signature) ``` ```python signature = self.headers.get("X-Hub-Signature-256", "") or \ self.headers.get("X-Signature-256", "") or \ self.headers.get("X-Slack-Signature", "") if signature and not verify_signature(body, signature, WEBHOOK_SECRET): logger.warning("Invalid signature — rejecting request") self.send_response(401) self.end_headers() return ``` ### Technical Analysis Signature verification is only performed when the request contains a recognized signature header. If the header is absent, the condition evaluates to false and request processing continues. In addition, `verify_signature()` explicitly returns `True` when no secret is configured. This creates two fail-open states: 1. A client can omit the signature header even when the server has a secret. 2. All verification is disabled when the secret file and `WEBHOOK_SECRET` environment variable are absent. Because the server binds to all network interfaces, this flaw can allow unauthenticated remote clients to submit forged events. ### Attack Path 1. An attacker identifies the webhook service listening on port 8443. 2. The attacker sends a JSON POST request without any recognized signature header. 3. The `if signature and ...` condition is skipped because `signature` is empty. 4. The attacker supplies an event type through ...[truncated 682 chars]- Remediation
View remediation