Description
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jovancoding | Network-AI | 5.0.0 – < 5.15.2 | 5.15.2 |
References
- GitHub Security Advisory (GHSA-hr6v-mfxm-4438) vendor-advisory
- VulnCheck Advisory: Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer third-party-advisory