October 2022 Summaries

The issue with the Jenkins Generic Webhook Trigger Plugin and the Jenkins Gitlab plugin is a timing-based side-channel attack vulnerability, where an attacker can use a non-constant time comparison function to execute an oracle attack against the hash verification, potentially recovering a secret key used for signing webhooks. To mitigate this, constant-time comparison functions should be used instead of naive implementations that compare strings character by character, which can reveal information about the password or signature. The issue applies to webhooks, where an attacker may try to find a valid signature using timing attacks, but it cannot be mitigated on the sender side; instead, customers can use open-source webhook signature libraries provided by Svix to ensure secure verification of signatures.

Most popular webhook providers were reviewed for their implementation of key features that make a great webhook experience, including automatic retries, exponential backoff, signature verification, manual retries, event types, multiple endpoint support, and log visibility. Stripe, GitLab, and Svix stood out as the top performers, offering all 7 features, while Shopify came close with 6. The review highlighted the importance of retry policies, with most providers having low retry limits, and noted that signature verification was a critical component to secure webhook services. Some providers were praised for their attention to detail in implementing these features, while others fell short in providing a seamless developer experience.