API-Induced SSRF: How Apple Pay Scattered Vulnerabilities Across the Web
summary
Shows that Apple Pay Web’s validation flow lets merchants proxy arbitrary URLs, leading to widespread SSRF; demos use curl and redeployments of vulnerable open‑source examples (Google Chrome Labs, WebKit) to fetch instance metadata 169.254.169.254 and retrieve tokens, and a Twilio webhook example exposes credentials because receivers ignore the HMAC signature missing; recommends whitelisting 30 Apple.com subdomains, egress filtering, or using Stripe/Braintree to avoid the design flaw.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:34Overview
- 8:34Apple Pay Web
- 10:49Google Chrome Labs
- 15:58Apples Response
- 19:34Webhooks
- 21:54Demo
- 28:57Apple
related talks
24mBitcoin Web Application Security
47mEsoteric Web Application Vulnerabilities
47mKeynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking
42mDiscovering and Exploiting Novel Security Vulnerabilities in Apple ZeroConf
31mHacking Web Server Apps for iOS
27miOS Attack Vectors and how to protect your app
50mModern WebApp Vulnerabilities
48mMobile Security Attacks: A Glimpse from the Trenches