Problem/Motivation

MailchimpWebhookController::endpoint() compares the hash with $webhook_hash !== $hash, this could make it vulnerable to timing attacks (the comparison is slightly slower if the beginning of the two strings is the same).

Steps to reproduce

Proposed resolution

We should probably use hash_equals() instead.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

prudloff created an issue. See original summary.

  • xenophyle committed d70d1b4e on 3.x 
    Issue #3531135: Harden webhook hash against timing attacks

  • xenophyle committed 38e83294 on 2.x 
    Issue #3531135: Harden webhook hash against timing attacks

  • xenophyle committed cdb32b1e on 3.x 
    Issue #3531135 by prudloff, xenophyle: Harden webhook hash against...

  • xenophyle committed f436e389 on 2.x 
    Issue #3531135 by prudloff, xenophyle: Harden webhook hash against...
xenophyle’s picture

xenophyle commented
Status: Active » Fixed

Committed to 2.x and 3.x branches.

  • xenophyle committed cdb32b1e on recipe_mergevars 
    Issue #3531135 by prudloff, xenophyle: Harden webhook hash against...

  • xenophyle committed d70d1b4e on recipe_mergevars 
    Issue #3531135: Harden webhook hash against timing attacks

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.