Back to Checks
googleworkspace

Incoming webhooks in Chat are disabled for users

chat_incoming_webhooks_disabled
Service: chatSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

Incoming webhooks let external applications post asynchronous messages into Google Chat spaces without being a Chat app. When enabled, users can configure webhooks and developers can call them to send content from external applications.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Exposed webhook URLs allow unauthorized content injection into Chat spaces. Attackers can send fraudulent or misleading messages that appear to come from trusted services, creating a vector for social engineering and phishing within internal communications.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks chat_incoming_webhooks_disabled

Recommendation

Disable incoming webhooks to prevent unauthenticated external applications from injecting content into internal Chat spaces.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Google Chat and classic Hangouts**
3Click **Chat apps**
4Under Chat apps access settings, set **Allow users to add and use incoming webhooks** to **OFF**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.chat.chat_client import chat_client


class chat_incoming_webhooks_disabled(Check):
    """Check that incoming webhooks are disabled in Google Chat.

    This check verifies that the domain-level Chat policy prevents users
    from adding and using incoming webhooks, reducing the risk of
    unauthorized content being posted into Chat spaces.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if chat_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=chat_client.policies,
                resource_id="chatPolicies",
                resource_name="Chat Policies",
                customer_id=chat_client.provider.identity.customer_id,
            )

            webhooks_enabled = chat_client.policies.enable_webhooks

            if webhooks_enabled is False:
                report.status = "PASS"
                report.status_extended = (
                    f"Incoming webhooks are disabled "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            elif webhooks_enabled is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Incoming webhooks use Google's secure default "
                    f"configuration (disabled) "
                    f"in domain {chat_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Incoming webhooks are enabled "
                    f"in domain {chat_client.provider.identity.domain}. "
                    f"Incoming webhooks should be disabled to prevent unauthorized content."
                )

            findings.append(report)

        return findings

References