Ruben Fiszel ab2a15b2a8 fix(triggers): prevent Zoom challenge handler from being used as a signing oracle (#9413) ...

The Zoom URL-validation challenge handler in `handle_challenge_request`
would HMAC-sign any arbitrary `plainToken` and return the result. Since
Zoom webhook verification checks `HMAC-SHA256(secret, "v0:{ts}:{body}")`,
an attacker could craft a `plainToken` in that format to obtain a valid
signature for a forged body, bypassing authentication on a later request.

Unlike the Twitch handler, the Zoom handler verifies no signature on the
challenge request (Zoom's protocol does not include one). Reject any
`plainToken` containing `:` or longer than 128 chars: legitimate Zoom
validation tokens are short random hex strings that never contain colons,
while the exploit requires the colon-bearing `v0:{ts}:{body}` format.

Fixes WIN-2008

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-02 12:47:45 +00:00

..

src

fix(triggers): prevent Zoom challenge handler from being used as a signing oracle (#9413)

2026-06-02 12:47:45 +00:00

Cargo.toml

fix: add timestamp validation to webhook signature verification (#8596)

2026-03-29 12:19:59 +00:00