Your Signature Check Let In Anyone Who Sent True

The webhook handler was careful.

Every request carried a token.

You decoded the JSON body,
pulled out the token,
and compared it
with the secret you expected.

If it did not match,
four hundred and three.

It worked for two years.

Then a researcher
sent you a request
where the token was not a string.

It was the word true,
without quotes.

And your handler
accepted it.

Here is the mechanism.

json_decode
gives you back real types.

A string in the JSON
becomes a string in PHP.

true in the JSON
becomes the boolean true.

Your check used two equals signs.

That is loose comparison.

When PHP compares
a boolean with a string,
it turns the string into a boolean first.

Any string that is not empty
and not the single character zero
becomes true.

Your secret was a long random string.

So it became true.

True equals true.

The attacker never needed
to know the secret.

Only that you compared it loosely.

The same trap
sits in other places
that compare loosely by default.

in_array,
unless you pass strict as true.

switch,
which compares cases
the same way.

And numeric strings,
where two hashes
that both start with zero e
followed only by digits
are read as numbers,
both zero,
and equal.

The type of the input
was chosen by the attacker,
and you never checked it.

So check it first.

If the token is not a string,
reject the request
before you compare anything.

Then compare with hash_equals,
which only compares strings
and takes the same time
whether the first character matches
or the last.

Three equals signs
would have stopped the boolean,
but they stop as soon as
a character differs,
and that leaks timing.

Then search the codebase
for two equals signs
next to anything
that came from a request.

You will find more than one.

A check is only as strict
as its comparison.

And the attacker
gets to choose
what you are comparing.

– Serguey Asael Shinder