Falhas do tipo CWE-1385

41 resultados

Falta de validação de origem em WebSockets

Aplicações que aceitam conexões WebSocket sem validar a origem (header Origin ou Referer) permitem que qualquer site faça requisições WebSocket em nome do usuário autenticado. Um atacante pode hospedar um site malicioso que, quando visitado por um usuário logado, envia comandos pela WebSocket já estabelecida, contornando a proteção de mesma origem.

Exemplo

Um app de banco usa WebSocket para transferências. Um atacante cria site que, ao ser visitado, faz a WebSocket (já autenticada no navegador) enviar uma transferência. O servidor não valida se a requisição veio do domínio legítimo e processa o comando.

Como mitigar

Valide explicitamente o header Origin ou Referer no servidor antes de aceitar a conexão WebSocket; combine com tokens CSRF e nonce por mensagem. Implemente whitelist de origens permitidas e rejeite conexões de domínios desconhecidos.

CVE-2023-2886MEDIUMCross-Site WebSocket Hijacking in CBOT's ChatbotEPSS 0.2%CVE-2025-54289HIGHPrivilege Escalation via WebSocket Connection Hijacking in LXD Operations APIEPSS 0.2%CVE-2025-56647MEDIUMnpm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate oriEPSS 0.2%CVE-2025-48068LOWInformation exposure in Next.js dev server due to lack of origin verificationEPSS 0.2%CVE-2026-15580MEDIUMPassPortal browser extension: vault token disclosure via unvalidated postMessageEPSS 0.2%CVE-2026-44211CRITICALCline Kanban Server has a Cross-Origin WebSocket Hijacking VulnerabilityEPSS 0.2%CVE-2026-21883MEDIUMBokeh server applications have Incomplete Origin Validation in WebSocketsEPSS 0.2%CVE-2026-34403MEDIUMNginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsEPSS 0.2%CVE-2026-71416HIGHHeadroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)EPSS 0.2%CVE-2023-32264MEDIUMCWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code anEPSS 0.2%CVE-2026-27977LOWNext.js: null origin can bypass dev HMR websocket CSRF checksEPSS 0.2%CVE-2026-44514MEDIUMKubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated usersEPSS 0.2%CVE-2026-35589HIGHnanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)EPSS 0.2%CVE-2025-36116MEDIUMIBM Db2 Mirror for i cross-site websocket hijackingEPSS 0.2%CVE-2026-85183CRITICALTaipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORSEPSS 0.2%CVE-2025-61987MEDIUMGroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validatEPSS 0.2%CVE-2026-13272MEDIUMSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.1%CVE-2026-18251MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.EPSS 0.1%CVE-2024-8201MEDIUMCross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center AnalyzerEPSS 0.1%CVE-2026-54565MEDIUMrhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pagesEPSS 0.1%