Symfony Twilio Notifier Webhook HMAC Signature Verification Vulnerability

A vulnerability exists in the Symfony framework's Twilio SMS notifier webhook parser, specifically in versions prior to 6.4.40, 7.4.12, and 8.0.12. The issue arises because the webhook parser's 'doParse' method receives the configured webhook secret but fails to verify the 'X-Twilio-Signature' HMAC header. This oversight allows unauthenticated POST requests to inject fake Twilio status payloads, potentially leading to delivery-metrics fraud and unauthorized automation triggers.

Impact

Exploitation of this vulnerability allows for the injection of forged Twilio status payloads into the application, bypassing authentication and verification mechanisms. This could result in fraudulent delivery metrics and unauthorized triggers of downstream automation processes.

Reproduction

To reproduce this vulnerability, send a POST request to a Symfony application endpoint configured to receive Twilio webhook events. Include Twilio status payload data but omit the 'X-Twilio-Signature' header or provide an invalid signature. The request will be accepted and processed, injecting the forged status payload into the application.

Remediation

Users can update to Symfony versions 6.4.40, 7.4.12, or 8.0.12, where this vulnerability has been fixed. The patch is available in the Symfony GitHub repository.