YooKassa

Yookassa Webhook Flaw Allowed Forging Payment Confirmations via Single Curl Request

A technical audit of a car rental service uncovered a critical flaw in the Yookassa webhook handler where payment.succeeded events were trusted without verification. The endpoint accepted the event type and gateway_payment_id directly from the client-supplied payload, enabling attackers to mark pending bookings as paid using a simple unauthenticated POST request. The vulnerability existed because the integration did not use Yookassa's optional Webhook-Signature mechanism and avoided IP allowlisting due to proxy infrastructure concerns. Developers addressed the issue by implementing a reverse API call to fetch authoritative payment status from Yookassa before updating records, ensuring fail-closed behavior on errors. New tests cover forgery attempts, amount mismatches, and idempotency, while several additional hardening measures were deliberately deferred to keep the patch minimal and reviewable. The original unit tests had masked the problem by simulating trusted input rather than validating source authenticity.

YooMoney's YuScan Automates E-commerce Risk Assessment Scanning Up to 1,000 Sites Per Hour

YooMoney has detailed the inner workings of its YuScan service, an automated auditing tool designed to help banks and payment providers identify websites that conceal prohibited or high-risk activities. Since 2020 the system has processed more than 550,000 merchant applications without resulting in any fines for servicing illegal operations. YuScan builds comprehensive site maps, executes JavaScript, and handles dynamic content using Playwright combined with Camoufox to evade modern anti-bot protections such as Cloudflare. The crawler is built on Scrapy with FastAPI and PostgreSQL, then applies ML models, embeddings, and LLMs to analyze text, images, reviews, and external signals including Roskomnadzor registries and WHOIS data. The automation has reduced manual review time dramatically, allowing half of compliant merchants to begin accepting payments within 24 hours. YooKassa now offers the service to other banks through NSPK, the operator of the Mir payment system.