T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/bridge_server.py:24- Finding
Unauthenticated Local WebSocket Channel Permits Arbitrary Gumtree Page Control
- Content
View full analysis
None: try: raw = await asyncio.wait_for(ws.recv(), timeout=10) except (asyncio.TimeoutError, Exception) as exc: logger.warning("握手超时或失败: %s", exc) return try: msg = json.loads(raw) except json.JSONDecodeError: return role = msg.get("role") if role == "extension": await self._handle_extension(ws) elif role == "cli": await self._handle_cli(ws, msg) else: logger.warning("未知 role: %s", role) ``` ```python async def _handle_cli(self, ws: ServerConnection, msg: dict[str, Any]) -> None: if msg.get("method") == "ping_server": await ws.send( json.dumps( {"result": {"extension_connected": self._extension_ws is not None}}, ensure_ascii=False, ) ) return if not self._extension_ws: await ws.send( json.dumps( {"error": "Extension 未连接，请确认浏览器已安装并启用 Gumtree Bridge 扩展"}, ensure_ascii=False, ) ) return msg_id = str(uuid.uuid4()) msg["id"] = msg_id loop = asyncio.get_event_loop() future: asyncio.Future[Any] = loop.create_future() self._pending[msg_id] = future await self._extension_ws.send(json.dumps(msg, ensure_ascii=False)) ``` The extension accepts the forwarded command and exposes arbitrary JavaScript evaluation in the page's main execution world: ```javascript async function handleCommand(msg) { const { method, params = {} } = msg; switch (method) { case "navigate": return await cmdNavigate(params); case "wait_for_load": return aw ...[truncated 3362 chars]- Remediation
View remediation