Symfony Mailomat Webhook Signature Validation Vulnerability Allows Algorithm Downgrade

A vulnerability exists in the Symfony Mailer component's Mailomat webhook signature validation. The issue is present in Symfony versions 7.2 through 7.4.12 and 8.0 prior to 8.0.13. The vulnerability arises because the validation method parses the 'X-MOM-Webhook-Signature' header and allows the signature algorithm to be downgraded by passing the wire-supplied algorithm to the 'hash_hmac()' function. This could lead to the acceptance of weaker signature algorithms instead of enforcing Mailomat's required SHA-256 signature. The vulnerability could be exploited if an attacker can compute a signature using a less secure algorithm and send it in the webhook request.

Impact

Exploitation of this vulnerability could allow an attacker to manipulate the signature validation process, potentially leading to unauthorized actions being performed by the webhook receiver. This could include bypassing security measures or causing the application to respond incorrectly to the webhook event.

Reproduction

To reproduce this vulnerability, send a webhook request to a Symfony application that uses the Mailomat webhook parser. Include the 'X-MOM-Webhook-Signature' header with a signature that uses a weaker algorithm, such as MD5 or SHA1. The request will be accepted, and the signature will be validated incorrectly, allowing the webhook to be processed as if it were legitimate.

Remediation

Users can upgrade to Symfony versions 7.4.13 or 8.0.13, where this vulnerability has been fixed.