OneUptime: WhatsApp Webhook Missing Signature Verification

Vulnerability

The WhatsApp POST webhook handler at /notification/whatsapp/webhook in OneUptime prior to version 10.0.34 processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature [1][3]. The codebase already implements proper signature verification for Slack webhooks, but the WhatsApp POST handler omits this check entirely [3].

Exploitation

An unauthenticated attacker can send a crafted HTTP POST request to the vulnerable endpoint with a forged JSON payload that mimics a legitimate WhatsApp business account status update [3]. No authentication or prior access is required; the attacker only needs network access to the OneUptime instance. The GET webhook correctly validates a verify token, but the POST handler—which processes actual event data—does not [3].

Impact

By forging delivery status updates, an attacker can manipulate notification delivery status records, suppress real alerts, and corrupt audit trails [1][3]. This could lead to missed incident notifications, false sense of security, and compromised monitoring integrity.

Mitigation

The issue has been patched in OneUptime version 10.0.34 [1]. Users should upgrade to this version or later. No workaround is documented; the fix adds proper HMAC signature verification to the WhatsApp webhook POST handler.