Weaknesses of type CWE-1385

34 results

Falta de validação de origem em WebSockets

Quando uma aplicação aceita conexões WebSocket sem verificar a origem da requisição (header Origin), um atacante pode estabelecer conexões de sites maliciosos e executar ações em nome do usuário legítimo. O servidor assume que toda conexão é confiável, abrindo brechas para CSRF e roubo de dados em tempo real.

Example

Um site malicioso (attacker.com) consegue abrir uma WebSocket para seu banco (bank.com) no navegador de uma vítima logada. Sem validação de origem, o servidor aceita e o atacante passa a interceptar mensagens ou executar transferências em tempo real.

How to mitigate

Sempre valide o header Origin ou Referer antes de aceitar a conexão WebSocket; compare contra uma lista explícita de domínios confiados. Use tokens CSRF específicos para WebSocket ou implemente autenticação robusta além de cookies.

CVE-2024-48849HIGHAuthentication and Authorization IssuesEPSS 0.9%CVE-2025-24964CRITICALRemote Code Execution when accessing a malicious website while Vitest API server is listeningEPSS 0.7%CVE-2025-68930HIGHTraccar Missing Origin Validation in WebSocketsEPSS 0.5%CVE-2023-0957HIGHAn issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability thEPSS 0.4%CVE-2024-23168CRITICALVulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting iEPSS 0.4%CVE-2014-125071MEDIUMlukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websocketsEPSS 0.4%CVE-2023-49805MEDIUMUptime Kuma Missing Origin Validation in WebSocketsEPSS 0.4%CVE-2023-30856HIGHeDEX-UI cross-site websocket hijacking vulnerability enables remote command executionEPSS 0.3%CVE-2023-26114HIGHVersions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnEPSS 0.3%CVE-2023-2850MEDIUMNodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vEPSS 0.3%CVE-2025-52882HIGHClaude Code IDE extensions allow websocket connections from arbitrary originsEPSS 0.3%CVE-2023-2848HIGHMovim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validatioEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2026-57111HIGHApache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-OriginEPSS 0.3%CVE-2024-51775HIGHApache Zeppelin: Command Injection via CSWSHEPSS 0.3%CVE-2026-59804HIGHMidscene Bridge Server - Session Hijack via Unauthenticated WebSocketEPSS 0.2%CVE-2026-22689MEDIUMMailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emailsEPSS 0.2%CVE-2023-2886MEDIUMCross-Site WebSocket Hijacking in CBOT's ChatbotEPSS 0.2%CVE-2025-54289HIGHPrivilege Escalation via WebSocket Connection Hijacking in LXD Operations APIEPSS 0.2%CVE-2025-56647MEDIUMnpm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate oriEPSS 0.2%