XenForo 2.3.12 build 2031270 fetched the URL supplied in the PayPal PAYPAL-CERT-URL webhook header without restricting its destination. The request was issued before the callback’s signature had been authenticated.
Technical details
The PayPal REST webhook handler passed PAYPAL-CERT-URL directly to its HTTP client. HTTP and HTTPS URLs were accepted, including private addresses and hosts unrelated to PayPal.
PAYPAL-CERT-URL: https://listener.example/cert.pem
XenForo sent the GET request before parsing the response as a certificate. Invalid certificate data caused later verification to fail but did not prevent the outbound request.
Reproduction
- Start an HTTP or HTTPS listener reachable from the XenForo server.
- Send a PayPal REST webhook request with
PAYPAL-CERT-URL set to the listener URL.
- Observe the inbound GET request from the XenForo host.
Impact
An unauthenticated webhook request could make the XenForo server issue HTTP or HTTPS GET requests to attacker-selected destinations, including private network addresses.
XenForo restricted certificate retrieval in 2.3.13.
References
XenForo 2.3.12 build 2031270 fetched the URL supplied in the PayPal `PAYPAL-CERT-URL` webhook header without restricting its destination. The request was issued before the callback's signature had been authenticated.
## Technical details
The PayPal REST webhook handler passed `PAYPAL-CERT-URL` directly to its HTTP client. HTTP and HTTPS URLs were accepted, including private addresses and hosts unrelated to PayPal.
```http
PAYPAL-CERT-URL: https://listener.example/cert.pem
```
XenForo sent the GET request before parsing the response as a certificate. Invalid certificate data caused later verification to fail but did not prevent the outbound request.
## Reproduction
1. Start an HTTP or HTTPS listener reachable from the XenForo server.
2. Send a PayPal REST webhook request with `PAYPAL-CERT-URL` set to the listener URL.
3. Observe the inbound GET request from the XenForo host.
## Impact
An unauthenticated webhook request could make the XenForo server issue HTTP or HTTPS GET requests to attacker-selected destinations, including private network addresses.
XenForo restricted certificate retrieval in 2.3.13.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-73315)
- [PoC](https://github.com/BomboBombone/CVE-2026-73315)
- [VulnCheck advisory](https://www.vulncheck.com/advisories/xenforo-ssrf-via-paypal-rest-webhook-handler)
- [XenForo 2.3.13 release](https://xenforo.com/community/threads/xenforo-2-3-13-and-add-ons-released-includes-security-fixes.239857/)
BomboBombone.exe