Unverified or tampered webhook causes a protected effect
An event is processed with privileged consequences without establishing the required sender and content authenticity.
Candidate CWE: CWE-345
Test hypothesis#
Capture a genuine controlled event, then test missing signature, invalid signature, and changed body with the unchanged signature in the local replica. Inspect the final worker effect as well as the immediate response, and compare an official-verifier control.
Evidence required#
Expected verification contract, exact signed bytes and metadata, reachable receiver path, rejected-versus-accepted controls, and the unauthorized synthetic state transition. Explain a realistic attacker delivery path.
Rule out false positives#
A public informational webhook intentionally needing no authenticity, a 2xx no-op, or the ability to sign events only because the tester installed the lab key does not prove a production forgery.
Playbook and command references#
- Webhooks and integration events: authenticity, tenant binding and replay — Verify the event signature, provider-to-tenant binding and durable worker effect together across retries and out-of-order delivery.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.