GHSA-3fcr-jvgp-7f58 pytonapi has a Webhook Custom Path Authentication Bypass
Webhook Custom Path Authentication Bypass in pytonapiSummary`TonapiWebhookDispatcher` in pytonapi 2.2.0 fails to validate the `Authorization` header when a webhook handler is registered with the documented `path=` argument. During `setup()`, bearer tokens are stored only under the default suffix paths (e.g., `/hook/account-tx`), but the custom path (e.g., `/hook/custom`) is never added to the token map. When an incoming request arrives at the custom path, `self._tokens.get(path)` returns `None`, causing the `if expected_token is not None` guard to evaluate to `False` and silently skip authentication entirely. An unauthenticated remote attacker can POST arbitrary forged payloads to the custom webhook endpoint and trigger victim-defined handlers with full integrity impact.DetailsThe vulnerability is a fail-open authentication check in `pytonapi/webhook/dispatcher.py`.**Token registration (setup)** stores tokens only under default suffix paths:**Handler registration** preserves the custom path in the handler tuple:**Path routing** (`_build_path_map`) correctly maps the custom path to the event type:**Authentication check** (fail-open):Because `expected_token` is `None` for any custom path, the condition `expected_token is not None` is always `False`. The `raise` is never reached regardless of what the `Authorization` header contains — or whether it is absent entirely. Execution continues to lines 291 and 297 where the attacker's payload is parsed and the victim handler is invoked.The `path=` argument is an officially documented feature (see `docs/webhooks/guide.mdx` lines 140 and 153), meaning any user following the public documentation is vulnerable.PoC**Requirements:** Python 3.12, pytonapi 2.2.0 installed from source (commit `e46c4a4`).**Build and run with Docker:**The Dockerfile installs pytonapi from the local source tree and executes `poc.py`.**What the PoC does:**Creates a `TonapiWebhookDispatcher` with a custom-path handler (`path="/hook/custom"`).Calls `setup()` — tokens are registered only for `/hook/account-tx`.**Case A** — calls `process("/hook/custom", forged_payload, authorization=None)`: no `Authorization` header, handler fires.**Case B** — calls `process("/hook/custom", forged_payload, authorization="Bearer totally-wrong-token")`: wrong token, handler still fires.**Case C** (control) — same attack against the default path `/hook/account-tx` with no auth: correctly raises `TONAPIError`.**Case D** (control) — default path with valid token: correctly accepted.**Simulated malicious HTTP request routed to the victim dispatcher:****Expected output confirming the vulnerability:****Remediation (patch):**ImpactThis is an **Improper Authentication** vulnerability (CWE-287). Any application that:Uses `TonapiWebhookDispatcher` from pytonapi 2.2.0, **and**Registers at least one handler using the documented `path=` keyword argument,is fully exposed. The webhook endpoint becomes publicly callable without credentials. An unauthenticated network attacker can:Forge arbitrary TON blockchain events (e.g., fake `account_tx` notifications).Trigger victim-defined business logic — payment processing, account state updates, notification dispatch — with attacker-controlled data.Cause financial or operational harm depending on what the victim handler does.Confidentiality is not directly affected (the attacker sends data, does not read it). Availability is not the primary impact. Integrity is critically impacted because the attacker fully controls the event data delivered to the handler.Reproduction artifacts`Dockerfile``poc.py`
CVSS v3.1 score: 7.5