Joshua Maddux - API Induced SSRF: How ApplePay Scattered Vulns Across the Web

Apple Pay API Induced SSRF

Joshua Maddux (security researcher) presents research identifying a class of SSRF vulnerabilities systematically introduced across thousands of e-commerce sites by Apple Pay integration requirements.

Apple Pay Merchant Validation

Apple Pay requires merchants to validate their identity with Apple's servers during payment sessions via a server-to-server API call. Merchant implementations accept the Apple payment session URL from the client-side JavaScript and proxy the validation request through their own server.

SSRF Introduction Pattern

When merchants implement this validation without validating the provided URL, the endpoint becomes a generic URL-fetching proxy — a textbook SSRF vulnerability. The bug exists in Apple's own integration documentation examples and in third-party payment libraries.

Scope of Impact

Maddux discovers this pattern across hundreds of major e-commerce sites, payment gateways, and SaaS platforms that followed Apple's integration documentation, demonstrating how a single API design decision propagated a vulnerability class at scale across the web ecosystem.