Executive brief
The @worker-tools/stripe-webhook library's constructEvent function fails to verify the authenticity of Stripe webhook requests, allowing attackers to forge webhook events without a valid signature. Applications relying on this function to validate incoming webhooks could be tricked into processing unauthorized events, potentially leading to unauthorized actions or data manipulation.
Technical details
The vulnerability is an authentication bypass in the constructEvent function, which is intended to securely construct and verify Stripe webhook events. The function fails to perform cryptographic signature verification on incoming webhook requests, accepting forged events that lack valid HMAC-SHA256 signatures. An unauthenticated attacker on the network can send arbitrary webhook payloads to an application endpoint that uses constructEvent, bypassing webhook validation entirely. The application would process these forged events as if they were legitimate Stripe webhooks. The vulnerability affects all versions prior to 1.1.4, which includes the fix. Users can work around the issue by calling verifyHeader() directly instead of relying on constructEvent.
Affected products
- worker-tools @worker-tools/stripe-webhook <1.1.4
Timeline
- 2021-05-28: disclosed: Advisory published on GitHub
- 2021-05-28: patched: Fix available in version 1.1.4