Symfony Mailtrap Webhook HMAC Signature Verification Vulnerability

A vulnerability exists in the Symfony Mailtrap Mailer Bridge webhook request parser, specifically in versions 7.2 through 7.4.11 and 8.0 prior to 8.0.12. The issue arises because the parser's 'doParse' method receives the configured webhook secret but fails to verify the 'X-Mt-Signature' HMAC header. This oversight allows unauthenticated POST requests to inject fake Mailtrap delivery, bounce, open, click, or spam events. As a result, applications can experience corruption of suppression lists and fraudulent delivery metrics.

Impact

Exploitation of this vulnerability allows for unauthorized injection of webhook events, which can disrupt application delivery metrics and corrupt suppression lists.

Reproduction

To reproduce this vulnerability, send a POST request to a Symfony application with the Mailtrap webhook endpoint configured. Include a payload that mimics a legitimate Mailtrap event, but omit the 'X-Mt-Signature' HMAC header or provide an invalid signature. The request will be accepted and processed, injecting the forged event into the application.

Remediation

Users can update to Symfony versions 7.4.12 or 8.0.12, both of which include the necessary patch. Instructions for updating can be found in the Symfony release notes.