Fallos del tipo CWE-1385

41 resultados

Validação ausente de origem em WebSockets

Ocorre quando uma aplicação WebSocket aceita conexões sem verificar se o cliente vem de um domínio autorizado. Um atacante em outro site consegue estabelecer um WebSocket direto com sua aplicação em nome de um usuário autenticado, executando ações maliciosas sem consentimento (ataque CSRF via WebSocket). Diferente do HTTP, browsers não enviam automaticamente o header Origin em todas as situações, então validá-lo no servidor é crítico.

Ejemplo

Um banco oferece transações via WebSocket. Um atacante cria um site que, ao ser visitado por um cliente do banco, abre um WebSocket para ws://banco.com/transacao e transfere dinheiro. Se o servidor não valida o Origin header, a conexão é aceita e o dano é feito.

Cómo mitigar

Valide sempre o header Origin (ou Sec-WebSocket-Origin) na função de upgrade do WebSocket e rejeite conexões de domínios não autorizados. Use tokens CSRF também em handshakes WebSocket, não confie apenas em autenticação de sessão.

CVE-2024-48849HIGHAuthentication and Authorization IssuesEPSS 0.9%CVE-2025-24964CRITICALRemote Code Execution when accessing a malicious website while Vitest API server is listeningEPSS 0.7%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.5%CVE-2023-0957HIGHAn issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability thEPSS 0.4%CVE-2024-23168CRITICALVulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting iEPSS 0.4%CVE-2014-125071MEDIUMlukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websocketsEPSS 0.4%CVE-2023-49805MEDIUMUptime Kuma Missing Origin Validation in WebSocketsEPSS 0.4%CVE-2023-2848HIGHMovim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validatioEPSS 0.4%CVE-2023-30856HIGHeDEX-UI cross-site websocket hijacking vulnerability enables remote command executionEPSS 0.3%CVE-2026-57111HIGHApache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-OriginEPSS 0.3%CVE-2023-26114HIGHVersions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnEPSS 0.3%CVE-2025-52882HIGHClaude Code IDE extensions allow websocket connections from arbitrary originsEPSS 0.3%CVE-2023-2850MEDIUMNodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vEPSS 0.3%CVE-2026-59804HIGHMidscene Bridge Server - Session Hijack via Unauthenticated WebSocketEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2024-51775HIGHApache Zeppelin: Command Injection via CSWSHEPSS 0.3%CVE-2026-88061MEDIUMcareer-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command executionEPSS 0.2%CVE-2026-22689MEDIUMMailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsEPSS 0.2%CVE-2026-59950HIGHMCP Python SDK: WebSocket server transport does not support Host/Origin validationEPSS 0.2%CVE-2026-10054HIGHIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shellEPSS 0.2%