Falhas do tipo CWE-1385

34 resultados

Falta de validação de origem em WebSockets

Aplicações que aceitam conexões WebSocket sem validar a origem (header Origin ou Referer) permitem que qualquer site faça requisições WebSocket em nome do usuário autenticado. Um atacante pode hospedar um site malicioso que, quando visitado por um usuário logado, envia comandos pela WebSocket já estabelecida, contornando a proteção de mesma origem.

Exemplo

Um app de banco usa WebSocket para transferências. Um atacante cria site que, ao ser visitado, faz a WebSocket (já autenticada no navegador) enviar uma transferência. O servidor não valida se a requisição veio do domínio legítimo e processa o comando.

Como mitigar

Valide explicitamente o header Origin ou Referer no servidor antes de aceitar a conexão WebSocket; combine com tokens CSRF e nonce por mensagem. Implemente whitelist de origens permitidas e rejeite conexões de domínios desconhecidos.

CVE-2024-48849HIGHAuthentication and Authorization IssuesEPSS 0.9%CVE-2025-24964CRITICALRemote Code Execution when accessing a malicious website while Vitest API server is listeningEPSS 0.7%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.5%CVE-2023-0957HIGHAn issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability thEPSS 0.4%CVE-2024-23168CRITICALVulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting iEPSS 0.4%CVE-2014-125071MEDIUMlukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websocketsEPSS 0.4%CVE-2023-49805MEDIUMUptime Kuma Missing Origin Validation in WebSocketsEPSS 0.4%CVE-2023-30856HIGHeDEX-UI cross-site websocket hijacking vulnerability enables remote command executionEPSS 0.3%CVE-2023-26114HIGHVersions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnEPSS 0.3%CVE-2023-2850MEDIUMNodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vEPSS 0.3%CVE-2025-52882HIGHClaude Code IDE extensions allow websocket connections from arbitrary originsEPSS 0.3%CVE-2023-2848HIGHMovim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validatioEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2026-57111HIGHApache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-OriginEPSS 0.3%CVE-2024-51775HIGHApache Zeppelin: Command Injection via CSWSHEPSS 0.3%CVE-2026-59804HIGHMidscene Bridge Server - Session Hijack via Unauthenticated WebSocketEPSS 0.2%CVE-2026-22689MEDIUMMailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsEPSS 0.2%CVE-2023-2886MEDIUMCross-Site WebSocket Hijacking in CBOT's ChatbotEPSS 0.2%CVE-2025-54289HIGHPrivilege Escalation via WebSocket Connection Hijacking in LXD Operations APIEPSS 0.2%CVE-2025-56647MEDIUMnpm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate oriEPSS 0.2%