EUVD-2026-46089
GHSA-7wwh-xcc3-9fcg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network endpoint with no complexity barriers; confidentiality limited to Low because SSRF is blind with no direct response returned.
Primary rating from Vendor (https://github.com/Paymenter/Paymenter).
CVSS VectorVendor: https://github.com/Paymenter/Paymenter
Lifecycle Timeline
2DescriptionCVE.org
Summary
The PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations.
Technical details:
The /extensions/paypal/webhook endpoint processes incoming webhook requests and trusts the value of the PAYPAL-CERT-URL HTTP header without validation.
This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage.
As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations.
Impact
This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints.
Depending on network configuration, this may lead to:
- Blind SSRF to external attacker-controlled systems
- Potential access to internal network services
No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels.
AnalysisAI
Blind Server-Side Request Forgery in Paymenter's PayPal gateway module (versions < 1.5.0) allows remote unauthenticated attackers to coerce the application server into issuing arbitrary HTTP GET requests by supplying a malicious URL in the PAYPAL-CERT-URL HTTP header. The webhook endpoint at /extensions/paypal/webhook passes this header directly to PHP's file_get_contents() with no allowlist, domain validation, or signature pre-check, violating the security intent of PayPal's certificate verification flow. No public exploit has been identified at time of analysis, but the zero-prerequisite attack surface and public advisory disclosure make this an accessible target for any unauthenticated actor who can reach the endpoint.
Technical ContextAI
Paymenter is a self-hosted PHP billing and client management platform distributed via Composer (pkg:composer/paymenter/paymenter). Its PayPal gateway extension implements webhook-based payment notification handling, which canonically requires fetching a PayPal-issued certificate to verify the IPN/webhook signature - a process that depends on a trusted certificate URL. The root cause maps to CWE-918 (Server-Side Request Forgery): the implementation unconditionally trusts the client-supplied PAYPAL-CERT-URL HTTP header as the certificate source URL, passing it directly into a file_get_contents() call before any signature or domain validation occurs. This inverts the security model - what should be a server-controlled trust anchor becomes an attacker-controlled request parameter. The PHP file_get_contents() function follows redirects by default and can reach internal RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and arbitrary external hosts, amplifying the impact beyond simple external probing.
RemediationAI
Upgrade Paymenter to version 1.5.0 or later, which is confirmed by the vendor's GitHub Security Advisory GHSA-7wwh-xcc3-9fcg (https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg) as the patched release. If an immediate upgrade is not feasible, restrict external access to the /extensions/paypal/webhook endpoint at the web server or firewall layer to allow only PayPal's documented IP ranges - note that this compensating control will block all non-PayPal requests but may still be bypassed if PayPal's IP ranges are not kept current; it also disrupts webhook functionality if PayPal's ranges change. A more surgical workaround is to deploy a WAF rule rejecting requests where the PAYPAL-CERT-URL header does not match *.paypal.com - this preserves functionality for legitimate webhooks while blocking arbitrary URL injection, but WAF rules are bypassable and must not substitute for patching. For cloud-hosted instances on AWS, GCP, or Azure, enabling IMDSv2 (which requires a session token and rejects simple GET requests) reduces the risk of cloud credential theft via SSRF as a secondary hardening measure regardless of patch status.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today