T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/browser-relay.js:62- Finding
Unauthenticated Browser Relay Exposes Screen Content and Full Browser Input Control
- Content
View full analysis
{ if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) { res.writeHead(200, { 'Content-Type': 'text/html' }); res.end(html); } else { res.writeHead(404); res.end('Not found'); } }); // WebSocket server for client interaction const wss = new WebSocket.Server({ server }); wss.on('connection', async (ws) => { clients.add(ws); console.log(`[browser-relay] client connected (${clients.size} total)`); // Restart screencast so frames flow to new clients try { await cdp.send('Page.stopScreencast').catch(() => {}); await cdp.send('Page.startScreencast', { format: 'jpeg', quality, maxWidth, maxHeight, everyNthFrame, }); console.log('[browser-relay] screencast restarted for new client'); } catch (e) { console.error('[browser-relay] screencast restart failed:', e.message); } ws.on('message', async (raw) => { try { const msg = JSON.parse(raw); await handleInput(cdp, msg, viewportWidth, viewportHeight); } catch (e) { console.error('[browser-relay] input error:', e.message); } }); ws.on('close', () => { clients.delete(ws); console.log(`[browser-relay] client disconnected (${clients.size} total)`); }); }); ``` ```js ser ...[truncated 1953 chars]- Remediation
View remediation