# Signature and manifest trust bypass

Trust anchors or security flags read from attacker-controlled URLs, manifests, or ambiguous signed fields

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2026-07-21. Updated 2026-10-24._

## How it works
A security decision trusts a value the attacker can influence: a signing-cert URL, a manifest flag, or a set of fields concatenated into an HMAC. The verifier checks one thing (a regex, a flag, a signature over a blob) but the enforcement path re-reads a different, attacker-controlled field. The assumption that "the signed/flagged value is the one we act on" breaks.

## Where it shows up
- Signature verification that fetches its public key from a URL supplied in the request [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-improper-validation-amazon-simple-notification-service.md)
- Host allowlist regexes that also match virtual-host or regional forms (bucket.s3-region.amazonaws.com) [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-improper-validation-amazon-simple-notification-service.md)
- HMAC over raw concatenation of variable-length fields with no delimiters or length prefixes [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md)
- Post-verification code that trusts URL-supplied IDs/names and re-looks-up by a different key [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md)
- Manifest flags (enabled=no, publishUrl presence) gating warnings or domain checks [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)
- Taskpane/link fields not restricted to embedded content [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)

## How to review
- For any signature scheme: is the trust anchor (cert/key URL) fixed and allowlisted by exact host, not regex? Enumerate every hostname form the regex accepts [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-improper-validation-amazon-simple-notification-service.md).
- For HMACs: are fields length-prefixed or delimited so distinct tuples cannot collide? Verify the exact bytes signed equal the bytes acted on [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md).
- After verification, does the handler re-derive identity from the signed data, or trust URL parameters? The invariant: every security-relevant field must be covered by the signature and re-read from it, not from the request [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md).
- For manifests: does enforcement read the same field the feature reads? Flip/remove each flag and confirm the control still holds [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md).

## Variants seen
- HMAC boundary-shift collision across adjacent fields, then trusting URL taskID/name [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md)
- Cert-URL host regex matching attacker-writable S3 bucket [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-improper-validation-amazon-simple-notification-service.md)
- Manifest flag suppression of code warning while code still runs; publishUrl removal skipping domain check [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md)

## Impact and severity
Cross-repo artifact read and cross-task write [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md); forged SNS webhooks to any subscriber [E2](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-improper-validation-amazon-simple-notification-service.md); code execution and domain-restriction bypass via crafted forms [E3](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md). Severity is high because the bypass defeats the only trust boundary; worse when the trust anchor is publicly writable or the regex is broad.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-hg5r-vq93-9fv6.md
- E2: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-improper-validation-amazon-simple-notification-service.md
- E3: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-embedding-payloads-bypassing-controls-microsoft-infopath.md