1. Executive Summary & Scope
Webhooks allow external third parties (payment processors, cloud alerts, CI systems) to notify an application of asynchronous events. If an application processes webhook events without verifying the provider's cryptographic signature, attackers can forge fake payment confirmations or user events.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-345 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
An attacker sends a fabricated webhook request claiming an invoice has been paid in full, unlocking digital products or services without actual financial transfer.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Trusting webhook payload without cryptographic signature verification
$payload = json_decode(file_get_contents('php://input'), true);
if ($payload['event'] === 'payment.success') {
markOrderAsPaid($payload['order_id']); // Insecure: Anyone can forge this request!
}
Hardened Defense-in-Depth Implementation
// REMEDIATED: Cryptographic HMAC SHA-256 signature verification
$payloadRaw = file_get_contents('php://input');
$signatureHeader = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$webhookSecret = Config::getSecret('WEBHOOK_SECRET');
$computedSignature = hash_hmac('sha256', $payloadRaw, $webhookSecret);
// Use constant-time comparison to prevent timing side-channel attacks
if (!hash_equals($computedSignature, $signatureHeader)) {
http_response_code(401);
log_security("Forged webhook signature rejected", ['ip' => get_client_ip()]);
die("Unauthorized webhook signature");
}
$payload = json_decode($payloadRaw, true);
processVerifiedEvent($payload);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Signature Tampering Test | Alter single character in webhook body while preserving signature. | Server rejects payload with 401 Unauthorized. |
| Timestamp Replay Defense | Inspect webhook payload for timestamp signature and enforce 5-minute replay window. | Replayed payloads older than 300 seconds are rejected. |
| Constant-Time Comparison | Verify code uses `hash_equals()` rather than standard `==` or `===`. | Prevents byte-by-byte timing attacks on HMAC signatures. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.