Logic-Error - CraftedSignal Threat Feed

Langroid Tool Invocation Bypass via Unverified User Messages (CVE-2026-54771)

hello@craftedsignal.io — Mon, 06 Jul 2026 20:45:48 +0000

A critical logic flaw (CVE-2026-54771) has been identified in Langroid applications, affecting versions up to and including 0.65.2. This vulnerability allows untrusted users interacting with a chat interface to directly invoke internal application tools by supplying raw JSON payloads. The handle_message() function within the ChatAgent lacks proper sender verification, permitting tools registered with use=False, handle=True to be executed, which developers might mistakenly believe are protected from direct user invocation. This bypass of intended security controls can lead to unauthorized actions such as file system manipulation, database command execution, or control over internal orchestration tools, posing a significant risk of remote code execution or sensitive data compromise.

Attack Chain

An attacker, as an untrusted user, interacts with a vulnerable Langroid chat application.
The attacker crafts a malicious chat message containing a raw JSON payload designed to invoke a specific internal tool, for example, {"request":"secret_tool","value":"pwned"}.
The Langroid ChatAgent receives the user's message as input.
The agent.handle_message() function is called to process the user's input.
Inside handle_message(), the get_tool_messages() method parses the raw JSON from the user message, identifying it as a valid ToolMessage invocation.
Despite the tool (e.g., SecretTool) being configured with use=False, handle=True, indicating it should not be directly generated by the LLM or exposed to end-users, its handle() method is directly executed.
The handle() method performs its intended action, which, depending on the tool, could include reading/writing files, executing database queries, or interacting with internal systems.
The attacker successfully bypasses security mechanisms to achieve unauthorized execution of internal tools, potentially leading to remote code execution or data exfiltration.

Impact

The impact of CVE-2026-54771 can be severe, leading to significant compromise of affected systems. Depending on the specific internal tools enabled within the Langroid application, attackers could achieve capabilities such as arbitrary file read and write, direct execution of database queries, or unauthorized access to and manipulation of internal orchestration systems. This could result in sensitive data exfiltration, system defacement, denial of service, or full remote code execution, undermining the integrity, confidentiality, and availability of the application and underlying infrastructure. Developers may have registered these tools with the belief that use=False provides sufficient protection, making this vulnerability particularly insidious.

Recommendation

Immediately patch Langroid applications to a version greater than 0.65.2 to address CVE-2026-54771.
Review all enable_message configurations within your Langroid applications, especially for sensitive tools, to ensure that only trusted entities can invoke them.
Implement robust input validation and sanitization at the application boundary for all user-supplied chat inputs to prevent raw JSON tool payloads from reaching the handle_message() function.

Non-Constant-Time HMAC Comparison in Pay Gem Paddle Billing Webhook Signature Verifier

hello@craftedsignal.io — Fri, 03 Jul 2026 12:39:17 +0000

The Ruby Pay gem, specifically versions equal to or older than 11.6.1, is vulnerable to a timing side-channel attack affecting its Paddle Billing webhook signature verification. The Pay::Webhooks::PaddleBillingController#valid_signature? method utilizes Ruby's non-constant-time String#== operator to compare the calculated HMAC with the attacker-supplied Paddle-Signature header. This allows an unauthenticated attacker to discern the correct HMAC character by character by observing subtle variations in response times. Successful exploitation grants the attacker the ability to forge arbitrary Paddle Billing webhook events, such as subscription.created or transaction.completed, which can lead to unauthorized provisioning of services, fraudulent refunds, or other business logic abuses within the victim application. The vulnerability is present in applications that mount Pay::Engine and enable paddle_billing, making the POST /pay/webhooks/paddle_billing endpoint publicly accessible to Paddle and, consequently, to attackers.

Attack Chain

Initial Access: An attacker identifies a Rails application utilizing the Pay gem (version <= 11.6.1) and exposing the POST /pay/webhooks/paddle_billing endpoint, which is publicly accessible for Paddle to deliver webhook events.
Information Gathering / Reconnaissance: The attacker crafts a series of requests to the exposed webhook endpoint, supplying a valid timestamp (ts=) and a systematically varying guessed HMAC signature (h1=) within the Paddle-Signature header.
Exploitation (Timing Side Channel): The vulnerable application processes each request, internally calculating the true HMAC for the raw post data and comparing it to the attacker's h1 guess using Ruby's String#==. Due to the non-constant-time nature of this comparison, the server's response time varies subtly based on how many leading characters of the h1 guess match the true HMAC.
Credential Access (HMAC Key Recovery): By sending a large number of requests and precisely measuring and analyzing the response times for each attempt, the attacker can use this timing oracle to accurately reconstruct the full 64-character hex-encoded SHA-256 HMAC, byte by byte, for a known payload.
Forging Webhooks: Once the HMAC signing secret is effectively known (as the HMAC for any given payload can be computed), the attacker can generate valid Paddle-Signature headers for arbitrary Paddle Billing webhook payloads that they construct.
Impact (Business Logic Abuse): The attacker then delivers these forged webhook events (e.g., subscription.created, transaction.completed, invoice.paid) to the /pay/webhooks/paddle_billing endpoint. The vulnerable application processes these forged events as legitimate, leading to unauthorized actions such as provisioning premium features for free, initiating fraudulent refunds, or triggering false customer notifications and database updates.

Impact

This vulnerability (CWE-208: Observable Timing Discrepancy) allows an unauthenticated attacker to fully compromise the integrity of Paddle Billing webhook events. By recovering the HMAC signing secret through a timing side-channel, attackers can forge any webhook event, effectively tricking the application into believing Paddle Billing sent it. This can lead to significant financial losses through fraudulent transactions (e.g., free access to paid features, unauthorized refunds), customer confusion from incorrect notifications, or data integrity issues due to malicious updates to billing states. Since the webhook endpoint must be internet-reachable by design, all Pay gem installations integrating with Paddle Billing are exposed to this risk. No specific victim counts or sectors were identified in the source, but any organization using the affected Pay gem version is at risk.

Recommendation

Immediately update the pay gem to a version greater than 11.6.1 to apply the fix that replaces the non-constant-time String#== comparison with ActiveSupport::SecurityUtils.secure_compare.
Review application logs for the /pay/webhooks/paddle_billing endpoint for unusually high request volumes from single IP addresses or abnormal response time distributions, which could indicate attempts at timing side-channel exploitation.
Review application-level audit logs for the Pay gem for any anomalous subscription.created, transaction.completed, or other financial event entries around the time of the vulnerability disclosure or patch deployment, as these could indicate forged events delivered by an attacker.