Authentication Bypass in FlexPrice via Missing Signature Verification

Executive Summary

This vulnerability is an authentication bypass in FlexPrice through version 2.1.38. It occurs in the HandleQuickBooksWebhook function where signature verification is skipped if the intuit-signature header is missing. Unauthenticated attackers with knowledge of a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices as paid or overpaid.

Useful 0 Not Useful 0

Detection Guidance

Check if FlexPrice webhook endpoints are exposed publicly without authentication. Inspect HTTP headers for missing intuit-signature in QuickBooks webhook requests. Verify if tenant and environment IDs are exposed in URLs or logs. Monitor for repeated payment notifications with identical payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to forge payment notifications, causing invoices to be marked as paid or overpaid without actual payment. This could lead to financial losses, incorrect billing records, and disruption of payment reconciliation processes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized changes in payment records, potentially violating data integrity requirements under GDPR and HIPAA. Incorrect billing data may also breach compliance with financial reporting standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FlexPrice to a patched version beyond 2.1.38. Ensure all webhook endpoints require signature verification and reject unsigned requests. Configure the webhook verifier token properly. Restrict public access to webhook routes and validate tenant/environment IDs in requests.

Useful 0 Not Useful 0