Description

Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the Paddle-Signature header using Ruby String#==. An unauthenticated remote attacker who can repeatedly submit requests to /pay/webhooks/paddle_billing and obtain sufficiently precise timing measurements can infer matching digest prefixes and recover a valid signature. A forged accepted webhook is enqueued through Pay::Webhooks::ProcessJob and can cause a host application to update billing state, provision paid features, record refunds, or trigger customer notifications. This issue is fixed in version 11.6.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-14T18:19:45.213Z",
  "pubdate": "2026-09-14T18:19:45.213Z",
  "executiveSummary": "A timing side-channel vulnerability exists in Pay versions prior to 11.6.2, specifically within the Pay::Webhooks::PaddleBillingController#valid_signature? method. The vulnerability arises from the use of insecure string comparison for HMAC validation of Paddle-Signature headers.\nBy measuring the time taken for the server to reject invalid signatures, an unauthenticated remote attacker can perform a statistical timing attack to recover a valid HMAC signature byte-by-byte. Successful exploitation allows an attacker to bypass signature verification, enabling the injection of arbitrary, forged webhook payloads.\nThe impact is critical, as it allows attackers to manipulate billing states, provision unauthorized services, trigger false refunds, or send malicious customer notifications. The vulnerability is exploitable over a network without requiring authentication, necessitating an immediate update to version 11.6.2 or later.",
  "technicalDetails": "The root cause of this vulnerability is the implementation of HMAC signature verification using the standard Ruby String#== operator within the Pay::Webhooks::PaddleBillingController#valid_signature? method located in app/controllers/pay/webhooks/paddle_billing_controller.rb. In Ruby, the standard equality operator for strings performs a short-circuit comparison; it returns false as soon as the first non-matching character is identified. This behavior introduces a measurable discrepancy in execution time proportional to the length of the matching prefix in the HMAC digest.\nThe exploitation process follows a side-channel methodology. An attacker sends a series of forged HTTP requests to the /pay/webhooks/paddle_billing endpoint, providing an arbitrary Paddle-Signature header containing a 64-character SHA-256 HMAC. By repeatedly submitting these requests and conducting high-precision timing measurements, the attacker can differentiate between comparisons that fail at the first byte versus those that fail at the second, third, and so on. Over multiple iterations, the attacker can statistically determine the correct character for each position in the signature, eventually reconstructing a valid HMAC hash that the application will accept as authentic.\nOnce the attacker successfully crafts a valid signature, the security controls governing the webhook process are bypassed. The application proceeds to enqueue the forged request through the Pay::Webhooks::ProcessJob. Because the application believes the request originated from a trusted source, it proceeds to execute sensitive backend logic.\nThe attack flow proceeds as follows: 1) The attacker targets the public webhook endpoint. 2) The attacker iteratively tests signature values while measuring server response time via timing analysis. 3) The attacker derives the valid signature after sufficient samples. 4) The attacker submits a malicious webhook payload using the recovered signature. 5) The application processes the forged job, leading to unauthorized state transitions, feature provisioning, or financial discrepancies. This vulnerability affects all versions of the Pay payments engine prior to 11.6.2."
}