APIFold MCP Server Webhook Signature Validation Bypass Leading to Untrusted Data Injection

Technical Analysis

The root cause is a configuration defect: `createWebhookRouter` is invoked without a `validators` map, causing an optional-chaining guard in `receivers.ts` to evaluate to undefined, which unconditionally skips the HMAC/signature validation block in `receiver.ts`. As a result, the `/webhooks/:serverSlug/:eventName` endpoint accepts and persists arbitrary unauthenticated JSON into Redis and a PostgreSQL `webhook_events` table. Because APIFold exposes this data as live MCP resource state, any MCP client consuming that resource will receive attacker-controlled content indistinguishable from legitimate webhook data, effectively allowing tool/data poisoning of the agent's context without compromising the underlying API or requiring authentication. The entry point is purely network-based (knowledge of a server slug is sufficient), and the impact crosses the boundary from a webhook ingestion pipeline into agent-trusted resource data.

Affected Systems

APIFold; protocols: MCP

Detection Signatures

• Unusually high volume of unauthenticated POST requests to /webhooks/:serverSlug/:eventName
• Webhook events lacking expected signature/HMAC headers being accepted and stored
• Redis or webhook_events table entries with malformed, unexpected, or anomalous JSON structure not matching known upstream webhook senders
• MCP resource responses containing data inconsistent with the legitimate webhook source's expected schema
• Absence of validators map passed to createWebhookRouter in server configuration/logs

Remediation Steps

1. 1

   Upgrade APIFold

   Apply commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 or later, which restores mandatory signature validation for webhook routers.

2. 2

   Enforce validator configuration

   Audit all calls to createWebhookRouter to ensure a non-empty validators map is always supplied, and add a startup-time assertion that fails closed if validators are missing.

3. 3

   Add fail-closed default

   Change the signature-validation guard logic so that undefined/missing validators reject requests by default rather than silently skipping validation.

4. 4

   Rotate and audit webhook data

   Audit existing webhook_events records and Redis-cached data for injected or anomalous payloads, and purge or quarantine any suspicious entries before they are served to MCP clients.

5. 5

   Treat webhook-derived MCP resources as untrusted

   Until patched, downstream MCP clients/agents should apply additional validation or provenance checks on resource data originating from webhook-backed endpoints.