Détail du CWE-1385

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

WebSockets provide a bi-directional low latency communication (near real-time) between a client and a server. WebSockets are different than HTTP in that the connections are long-lived, as the channel will remain open until the client or the server is ready to send the message, whereas in HTTP, once the response occurs (which typically happens immediately), the transaction completes.

A WebSocket can leverage the existing HTTP protocol over ports 80 and 443, but it is not limited to HTTP. WebSockets can make cross-origin requests that are not restricted by browser-based protection mechanisms such as the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS). Without explicit origin validation, this makes CSRF attacks more powerful.

Modes d'introduction

Architecture and Design
Implementation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Technologies

Name: Web Server (Undetermined)

Conséquences courantes

Exemples observés

Mesures d’atténuation potentielles

Phases : Implementation
Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
Phases : Implementation
Use a randomized CSRF token to verify requests.
Phases : Implementation
Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
Phases : Architecture and Design // Implementation
Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
Phases : Implementation
Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
Phases : Implementation
Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
Phases : Implementation
Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commentaire : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Références

REF-1257

Cross-Site WebSocket Hijacking (CSWSH)
Christian Schneider.
https://christian-schneider.net/CrossSiteWebSocketHijacking.html

REF-1251

WebSockets not Bound by SOP and CORS? Does this mean...
Drew Branch.
https://blog.securityevaluators.com/websockets-not-bound-by-cors-does-this-mean-2e7819374acc

REF-1252

How to secure your WebSocket connections
Mehul Mohan.
https://www.freecodecamp.org/news/how-to-secure-your-websocket-connections-d0be0996c556/

REF-1256

Cross-Site WebSocket Hijacking (CSWSH)
Vickie Li.
https://medium.com/swlh/hacking-websocket-25d3cba6a4b9

REF-1253

Testing for WebSockets security vulnerabilities
PortSwigger.
https://portswigger.net/web-security/websockets

Soumission

Modifications