Plunk Webhook Forgery Vulnerability in Amazon SNS Integration

A vulnerability exists in Plunk, an open-source email platform that utilizes AWS SES, in versions prior to 0.9.0. The issue arises in the /webhooks/sns endpoint, which processes Amazon SNS notification payloads from unauthenticated requests without proper verification of the SNS signature, certificate, or topic ARN. This lack of validation allows anyone to forge a webhook request that appears legitimate. As a result, an unauthenticated attacker could spoof SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially deplete billing credits.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of workflow automations, contact subscriptions, email delivery metrics, and billing credits.

Remediation

Users can upgrade to Plunk version 0.9.0 or later, where this vulnerability has been patched.