Description

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-08T14:17:25.780Z",
  "pubdate": "2026-09-08T14:17:25.780Z",
  "executiveSummary": "XenForo versions prior to 2.3.13 are susceptible to a critical Server-Side Request Forgery (SSRF) vulnerability residing within the PayPal REST webhook handler.\nThis vulnerability allows unauthenticated remote attackers to force the XenForo application server to initiate arbitrary outbound HTTP requests.\nBy manipulating specific webhook headers to provide a crafted certificate URL, an attacker can bypass internal network security controls.\nThe primary risk involves the potential for unauthorized access to sensitive internal network resources, including cloud-based instance metadata services (e.g., AWS IMDS), which may result in the exfiltration of IAM security credentials or the compromise of internal microservices.\nThe flaw stems from a failure to perform adequate input validation on the scheme, hostname, or allowlist of URLs processed by the webhook handling logic.\nSuccessful exploitation requires no prior authentication, posing a severe threat to the confidentiality and integrity of the hosting environment.",
  "technicalDetails": "The vulnerability is located in the PayPal REST webhook processing component of XenForo. When the application receives a POST request at the designated PayPal webhook callback endpoint, the underlying logic attempts to process the payload and verify the authenticity of the notification.\nThe root cause of this vulnerability is improper validation of the 'certificate_url' or equivalent headers provided in the webhook request. The application fails to implement strict parsing of the provided URL, specifically neglecting to validate the URI scheme (e.g., ensuring it is restricted to HTTPS), the hostname (e.g., ensuring it points to a legitimate PayPal-owned domain), or performing any form of allowlist validation against the destination.\nThe attack flow begins when an unauthenticated attacker transmits a malicious POST request to the XenForo PayPal webhook endpoint. Within the headers of this request, the attacker specifies a target URL pointing to an internal infrastructure component, such as 'http://169.254.169.254/latest/meta-data/iam/security-credentials/role-name'.\nUpon receipt, the XenForo application server initiates an HTTP request to the attacker-supplied URL, treating the outbound request as a legitimate server-to-server communication. Because the request originates from the server itself, it is frequently trusted by internal services that do not require external authentication.\nThe absence of a URL allowlist allows the attacker to reach internal metadata services or other private network assets that are not reachable from the public internet. This interaction facilitates the retrieval of sensitive data, such as cloud instance identity documents or temporary security credentials, which an attacker can then leverage to assume the identity of the server's service role.\nThis SSRF vector effectively bypasses traditional perimeter defenses, as the XenForo host acts as a proxy for the malicious traffic. The lack of validation on the URL structure enables attackers to perform reconnaissance on the internal network topology or interact with internal APIs that lack sufficient authorization mechanisms for requests originating from the internal network.\nPost-exploitation impact includes full credential theft if the server is hosted on a cloud provider with an accessible metadata service, enabling lateral movement and potential escalation of privilege across the attacker's cloud infrastructure."
}