Weakness (CWE)
CWE-1385: Missing Origin Validation in WebSockets
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
How to prevent it (7 mitigations)
-
Implementation
Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
-
Implementation
Use a randomized CSRF token to verify requests.
-
Implementation
Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
-
Architecture and Design, Implementation
Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
-
Implementation
Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
-
Implementation
Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
-
Implementation
Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.
Source: MITRE CWE-1385
51 results · Feed
-
Medium 6.5
Vite allows any websites to send any requests to the development server and read the response
Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulner…
-
Critical 9.8
Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSo…
-
Medium 5.8
CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upl…
-
Medium 6.0
Uptime Kuma Missing Origin Validation in WebSockets
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on…
-
High 8.0
Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a mis…
-
Medium 4.7
Unintentional leakage of private information via cross-origin websocket session hijacking
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.
-
Medium 4.3
Cross-Site WebSocket Hijacking in CBOT's Chatbot
Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
-
High 8.3CVE-2023-30856 Public exploit
eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution
eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbit…
-
High 8.2
code-server vulnerable to Missing Origin Validation in WebSockets
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
-
High 8.2
An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CS…
-
Medium 5.5
lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets
A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request/HttpRequestHandler.java. The manipulation leads to missing origin validation in websockets. The nam…