Description
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
flexprice flexprice
Default version status: unaffected
0 to ≤ 2.1.38affected
References
- https://hackmd.io/@hieuPenguinnn/flexprice-quickbooks-webhook-signature-bypass ↗
- https://github.com/flexprice/flexprice/blob/f27da32f84ee34bad4bf39a8d887af87fc3f30fc/internal/api/v1/webhook.go#L750 ↗
- https://github.com/flexprice/flexprice ↗
- https://www.vulncheck.com/advisories/flexprice-through-2.1.38-quickbooks-webhook-signature-verification-bypass ↗