Executive brief
XenForo is a community forum and discussion platform. The PayPal webhook handler in versions before 2.3.13 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to make the XenForo server fetch arbitrary URLs by crafting malicious webhook requests. This can expose internal network resources, cloud metadata services, and IAM credentials, or enable lateral movement to other internal systems.
Technical details
The vulnerability exists in the PayPal REST webhook handler, which blindly fetches the URL supplied in the PAYPAL-CERT-URL webhook header without validating the destination or requiring PayPal hostname constraints. The HTTP/HTTPS GET request is issued before the webhook signature is verified, allowing unauthenticated attackers to reach internal network addresses, localhost, and cloud metadata endpoints. Attackers can exploit this via a POST to the PayPal webhook callback endpoint with a crafted PAYPAL-CERT-URL header pointing to attacker-controlled or internal destinations. The fix in XenForo 2.3.13 restricts certificate retrieval by validating URLs and likely adding an allowlist of permitted destinations.
Affected products
- XenForo XenForo before 2.3.13
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: XenForo 2.3.13 released with fix