# Local applications from user's computer can listen for webhooks via insecure gRPC server from stripe-cli

stripe-cli's local gRPC daemon lacks authentication, letting any local app invoke Listen and receive the victim's account webhooks.

- Payout: hidden
- Severity: low
- Program: Stripe
- Found by: gregxsunday
- Disclosed: 2022-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1369191
- Library page: https://bugbountylibrary.com/r/h1%3A1369191
- Tags: area:web3 domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:grpc technique:source-review vuln:access-control vuln:auth-bypass

**Target:** local gRPC server exposed by stripe daemon command
**Root cause:** The stripe daemon's local gRPC server requires no authentication, so any local process can call privileged RPCs including Listen.
**Steps:**
1. Install stripe-cli and run `stripe daemon` to start the local gRPC server
2. From another local application, connect to the gRPC endpoint without credentials
3. Invoke the `Listen` RPC (equivalent to `stripe listen`)
4. Observe webhooks for the user's Stripe account delivered to the attacker's client
**How found:** Researcher inspected stripe-cli's daemon command and noticed the local gRPC server exposed RPCs like Listen without authentication.
**Exploitation:** Attacker must already have a malicious application installed on the victim's machine; that app connects to the unauthenticated local gRPC server, calls Listen, and receives all webhooks for the victim's Stripe account.
**Insight:** Localhost gRPC/HTTP daemons shipped by CLIs are often unauthenticated; enumerate their service definitions for privileged RPCs like Listen that mirror sensitive CLI commands.