Exports and webhook authenticity
An export job and a webhook are both delayed authority. The job must stay bound to the account that created it. The webhook must fail when the signature is missing, and a signature check that throws must not fail open.
Tags: webhook, tenant, export
Level: intermediate
Method
Start an export you are allowed to run
Save the job id. As a second account you own, request status and download. The other account should see nothing.
Tools: Burp Suite
File URLs
If the finished file has its own URL, request it with the second account and with no session. A signed URL is fine. A guessable path is the note.
Tools: Burp Suite
Webhook signature absent
On a test endpoint and a test event you created, omit the signature header. Acceptance means the signature is optional.
Tools: Burp Suite
Error path
A verifier that throws and still applies the event is fail-open. Record the event id and the state change on your own object.
Tools: Burp Suite
Replay of your event
Send your own test event twice. If there is no event id or timestamp check, document that. Do not replay a customer event.
Tools: Burp Suite
URL fetch is a different bug
If the product fetches a URL you supply to test the webhook, that is the SSRF hunt. Do not mix it into the signature report.
Tools: browser
Field notes
- The signature secret is not yours to brute force.
- A webhook from a provider you configured in your own org is the right test bed.
- Export bugs and webhook bugs can share a ticket only when they share a cause.