Webhook Abuse with Bearer Tokens

Webhook abuse in Bearer Tokens applications typically exploits the token-based authentication system to flood endpoints with malicious or excessive webhook requests. Attackers can abuse Bearer Tokens in several ways:

• Token Replay Attacks: Intercepted or leaked Bearer Tokens can be replayed to send unauthorized webhook events to third-party services, potentially causing data exfiltration or service disruption
• Token Scope Escalation: Attackers may craft webhook requests with elevated permissions by manipulating token scopes, bypassing intended access controls
• Denial-of-Service via Webhooks: Malicious actors can flood an API with webhook registrations using stolen tokens, overwhelming notification systems or triggering expensive operations

In Bearer Tokens implementations, this often appears in code paths where tokens are validated but webhook destinations aren't properly authenticated. For example:

// Vulnerable pattern in Bearer Tokens applications
app.post('/webhook', authenticateToken, (req, res) => {
  const token = req.headers.authorization.split(' ')[1];
  const webhookUrl = req.body.url;
  
  // ⚠️ Missing validation of webhookUrl destination
  sendWebhookEvent(webhookUrl, token, eventPayload);
});

The vulnerability here is that while the token is authenticated, there's no verification that the webhook destination is legitimate or that the token has permission to send to that specific endpoint. Attackers can register malicious URLs or use tokens from other users to create unauthorized webhook chains.

Detecting webhook abuse in Bearer Tokens requires examining both the token validation logic and webhook registration flows. Key indicators include:

• Token Scope Analysis: Check if webhook endpoints properly validate token scopes against the requested webhook destination
• Destination Whitelisting: Verify that webhook URLs are restricted to approved domains or services
• Rate Limiting on Webhook Registrations: Ensure there are limits on how many webhooks can be registered per token

Using middleBrick's API security scanner, you can detect these vulnerabilities by scanning your Bearer Tokens endpoints:

# Scan your Bearer Tokens webhook endpoints
middlebrick scan https://api.yourservice.com/webhook

middleBrick tests for webhook abuse by attempting to register malicious webhook destinations, checking if tokens can be used to send webhooks to unauthorized endpoints, and verifying that scope validation is properly enforced. The scanner runs 12 parallel security checks including Authentication bypass attempts and Input Validation tests specifically targeting webhook functionality.

For Bearer Tokens applications, middleBrick's LLM/AI Security checks are particularly relevant, as webhook abuse often involves AI-powered services that process the incoming events. The scanner can detect if your webhook endpoints inadvertently expose system prompts or allow prompt injection through webhook payloads.

Securing webhook endpoints in Bearer Tokens applications requires implementing proper validation and authorization controls. Here's how to fix common vulnerabilities:

// Secure webhook registration in Bearer Tokens
app.post('/webhook/register', authenticateToken, validateScopes(['webhook:write']), (req, res) => {
  const token = req.headers.authorization.split(' ')[1];
  const webhookUrl = req.body.url;
  
  // 1. Validate webhook destination
  if (!isValidWebhookDestination(webhookUrl)) {
    return res.status(400).json({ error: 'Invalid webhook destination' });
  }
  
  // 2. Check token permissions for this specific URL
  if (!hasPermissionForWebhook(token, webhookUrl)) {
    return res.status(403).json({ error: 'Insufficient permissions' });
  }
  
  // 3. Rate limit webhook registrations
  if (exceedsWebhookLimit(req.user.id)) {
    return res.status(429).json({ error: 'Webhook limit exceeded' });
  }
  
  // 4. Store webhook securely
  const webhook = createWebhookRecord(req.user.id, webhookUrl);
  
  res.status(201).json(webhook);
});

Key remediation steps:

1. Destination Validation: Implement isValidWebhookDestination() to whitelist approved domains and services
2. Scope-Based Authorization: Use Bearer Tokens' built-in scope validation to ensure tokens only have webhook permissions they need
3. Rate Limiting: Apply per-user and per-token rate limits on webhook operations
4. Permission Hierarchies: Verify that tokens can only create webhooks for resources they own

For existing webhook endpoints, add validation middleware:

function validateWebhookAccess(req, res, next) {
  const token = req.headers.authorization.split(' ')[1];
  const webhookId = req.params.webhookId;
  
  // Verify token owns this webhook
  if (!webhookBelongsToUser(token, webhookId)) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  next();
}