HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

HMAC proves that a request originated from someone who possesses the shared secret, but it does not guarantee the request's freshness. When APIs sign requests without including a timestamp in the signed payload, they are vulnerable to replay attacks. A captured request can be used multiple times, functioning as a standing credential for that action.

HMAC-SHA256, a common signing algorithm, is deterministic, meaning that the same key and message always produce the same message authentication code (MAC). This deterministic property is what makes HMAC suitable for origin authentication, but it also allows for replay attacks when there is no freshness field in the signed payload.

Signature verification confirms two things: the sender's possession of the secret and the integrity of the message, but it does not confirm when the message was generated or whether it has been processed before. This is a fundamental limitation of HMAC-based authentication schemes. Without a timestamp or nonce in the signed payload, the server has no mechanism to inspect and validate the request's freshness.

Attackers can capture valid credentials or requests and replay them at a later time to bypass authentication, a pattern classified by MITRE as CWE-294 (Authentication Bypass by Capture-replay). This exact vulnerability has been identified in various APIs, including RBKmoney, Shopify, python-oauth2, Mattermost Zoom plugin, and Stripe.

RBKmoney accepted Apple Pay cryptograms for repeated charges without checking the time, while Shopify accepted payment webhook deliveries without signature verification. python-oauth2 and Mattermost Zoom plugin also suffered from missing nonce validation, allowing OAuth requests to be replayable. Stripe addressed this issue by including a timestamp in the signed payload, enabling the server to validate the request's freshness.

Multiple CVEs have been reported due to the lack of timestamp validation in production systems, affecting products such as lakeFS S3 gateway, Open edX LTI provider, SAP HMAC auth, and Mattermost Zoom plugin. These vulnerabilities can lead to significant security risks, including unauthorized access, data manipulation, and system compromise.