Go · github.com/QuantumNous/new-api
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging
Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.
Affected public endpoints included:
POST /api/stripe/webhookPOST /api/creem/webhookPOST /api/waffo/webhookThis issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.
A remote unauthenticated attacker could cause denial of service through memory pressure, container OOM/restarts, or disk consumption from full-body logging. The impact is availability-only and is rated High.
Versions before v1.0.0-rc.11 are affected. The earlier affected range of <= v1.0.0-rc.7 was incomplete; the anonymous request body limit was introduced later and first appears in v1.0.0-rc.11.
This issue is fixed in v1.0.0-rc.11. The fix adds middleware.AnonymousRequestBodyLimit() and applies it to unauthenticated POST routes, including the payment webhook callbacks. The default limit is controlled by ANONYMOUS_REQUEST_BODY_LIMIT_KB and defaults to 512 KiB.
If upgrading immediately is not possible, operators should disable unused payment webhooks, enforce request body limits at a reverse proxy or load balancer, and ensure application and container logs have rotation and quotas. These mitigations reduce exposure but do not replace upgrading.
d2f7f9ee3adf3ef66798783a60d7bc712451c85c.router/api-router.go, middleware/request_body_limit.go, controller/topup_stripe.go, controller/topup_creem.go, and controller/topup_waffo.go.Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.