T05 · Unauthorized Access and Privilege Escalation
Error
- Location
odoo_skill/sync/webhook.py:31- Finding
Network-Exposed Webhook Server Permits Unauthenticated Event Injection by Default
- Content
View full analysis
None: """Handle an incoming webhook POST request.""" content_length = int(self.headers.get("Content-Length", 0)) if content_length == 0: self._respond(400, {"error": "Empty body"}) return body = self.rfile.read(content_length) # Signature verification if self.webhook_secret: signature = self.headers.get("X-Odoo-Signature", "") expected = hmac.new( self.webhook_secret.encode("utf-8"), body, hashlib.sha256, ).hexdigest() if not hmac.compare_digest(signature, expected): logger.warning( "Webhook signature mismatch (remote=%s)", self.client_address[0], ) self._respond(401, {"error": "Invalid signature"}) return ``` ```python def __init__( self, port: int = 8069, host: str = "0.0.0.0", secret: str = "", ) -> None: self.port = port self.host = host self.secret = secret ``` ```python def start(self) -> None: """Start the webhook server in a background thread.""" _WebhookHandler.webhook_secret = self.secret _WebhookHandler.callbacks = self._callbacks _WebhookHandler.default_callback = self._default_callback self._server = HTTPServer((self.host, self.port), _WebhookHandler) ``` ### Technical Analysis The webhook server binds to `0.0.0.0` by default, making it reachable th ...[truncated 2012 chars]- Remediation
View remediation