Falhas do tipo CWE-1385

49 resultados

Falta de validação de origem em WebSockets

Aplicações que aceitam conexões WebSocket sem validar a origem (header Origin ou Referer) permitem que qualquer site faça requisições WebSocket em nome do usuário autenticado. Um atacante pode hospedar um site malicioso que, quando visitado por um usuário logado, envia comandos pela WebSocket já estabelecida, contornando a proteção de mesma origem.

Exemplo

Um app de banco usa WebSocket para transferências. Um atacante cria site que, ao ser visitado, faz a WebSocket (já autenticada no navegador) enviar uma transferência. O servidor não valida se a requisição veio do domínio legítimo e processa o comando.

Como mitigar

Valide explicitamente o header Origin ou Referer no servidor antes de aceitar a conexão WebSocket; combine com tokens CSRF e nonce por mensagem. Implemente whitelist de origens permitidas e rejeite conexões de domínios desconhecidos.

CVE-2026-85183CRITICALTaipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORSEPSS 0.2%CVE-2026-59950HIGHMCP Python SDK: WebSocket server transport does not support Host/Origin validationEPSS 0.2%CVE-2025-56647MEDIUMnpm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate oriEPSS 0.2%CVE-2026-10054HIGHIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shellEPSS 0.2%CVE-2025-54289HIGHPrivilege Escalation via WebSocket Connection Hijacking in LXD Operations APIEPSS 0.2%CVE-2026-85267HIGHCross-Site WebSocket Hijacking in Google Cloud ShellEPSS 0.2%CVE-2023-2886MEDIUMCross-Site WebSocket Hijacking in CBOT's ChatbotEPSS 0.2%CVE-2025-48068LOWInformation exposure in Next.js dev server due to lack of origin verificationEPSS 0.2%CVE-2026-54565MEDIUMrhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pagesEPSS 0.2%CVE-2026-18251MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.EPSS 0.2%CVE-2026-109330MEDIUMNetwork-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServerEPSS 0.2%CVE-2026-27977LOWNext.js: null origin can bypass dev HMR websocket CSRF checksEPSS 0.2%CVE-2026-44211CRITICALCline Kanban Server has a Cross-Origin WebSocket Hijacking VulnerabilityEPSS 0.2%CVE-2025-36116MEDIUMIBM Db2 Mirror for i cross-site websocket hijackingEPSS 0.2%CVE-2026-34403MEDIUMNginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpointsEPSS 0.2%CVE-2026-21883MEDIUMBokeh server applications have Incomplete Origin Validation in WebSocketsEPSS 0.2%CVE-2026-71416HIGHHeadroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)EPSS 0.2%CVE-2023-32264MEDIUMCWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code anEPSS 0.2%CVE-2026-44514MEDIUMKubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated usersEPSS 0.2%CVE-2026-104380MEDIUMPunk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_oneEPSS 0.2%