HiEvents Multiple Vulnerability Fixes: Webhook SSRF, Formula Injection, and Race Conditions

Vulnerability Overview This page summarizes the remediation of multiple security vulnerabilities, including Webhook SSRF, Spreadsheet formula injection, Order completion race, Product sale window, max_per_order, Product ownership validation, Public promo code lookup, Cross-event question tampering, and Order, attendee, product and check-in webhook dispatch jobs. Impact Scope Webhook SSRF: Affects all HiEvents users who utilize Webhooks. Spreadsheet formula injection: Affects all users who export CSV reports. Order completion race: Affects all users who create attendees and populate and . Product sale window: Affects all users who sell products. max_per_order: Affects all users who aggregate orders by product. Product ownership validation: Affects all users who organize events and validate product ownership. Public promo code lookup: Affects all users who use promo codes. Cross-event question tampering: Affects all users who edit or delete questions across events. Order, attendee, product and check-in webhook dispatch jobs: Affects all users who use Webhook dispatch jobs. Remediation Webhook SSRF: The URL guard previously ran only during creation, allowing redirects and DNS rebinding to reach internal and cloud metadata hosts. The response body is now re-validated through the Webhook Logs API, and IPv6 transition addresses (NAT64, Broto, Teredo, IPv4-compatible) are decoded, which previously bypassed filters. Spreadsheet formula injection: Unvalidated attendee names and question answers were previously exported as formulas when exporting within an organization. All exports now explicitly escape strings, and CSV reports escape formula triggers. Order completion race: Concurrent completion of the same order, where attendees were created and and were populated, depleted capacity and blocked other buyers. Completion now acquires an advisory lock before reading the order. Product sale window: This is now enforced at checkout, at both the product and price level, preventing tickets from being purchased before sales start, after sales end, or on expired lower-priced tiers. max_per_order: Orders are now aggregated by product, and duplicate entries are counted per item rather than per line item, preventing the limit from being bypassed by repeating the same . Product ownership validation: Validation is now applied to questions, capacity allocation, and checklists. Consequently, events from another organization can no longer be attached, and cross-event updates and deletions return a 404 instead of silently detaching the victim's products. Public promo code lookup: A dedicated rate limiter has been implemented, matching its sibling public route, to prevent code enumeration. Cross-event question tampering: Editing or deleting questions previously updated rows scoped to another event, but not the pivot table, allowing attackers to rewrite the question associations and answers for a victim's product. Both paths now validate ownership first. Order, attendee, product and check-in webhook dispatch jobs: These jobs now implement . Previously, they ran inline within the request, despite the listener assigning them to a queue. POC Code or Exploit Code No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

HiEvents Multiple Vulnerability Fixes: Webhook SSRF, Formula Injection, and Race Conditions

More from this source