T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.js:86- Finding
Unauthenticated WebSocket API Permits Complete Browser Control and Arbitrary Page-Context JavaScript
- Content
View full analysis
{ console.log('🔌 新的客户端连接'); ws.on('message', async (message) => { try { const { action, params, id } = JSON.parse(message); console.log(`⚡ 收到指令：${action}`, params); if (!browser) await initBrowser(); if (!page) page = await browser.newPage(); if (params.targetId) { // 简单处理：如果有 targetId 且不是当前页，尝试切换（简化版暂不实现多 Tab 切换逻辑，默认单页） // 实际使用中，可以扩展为多 page 管理 } const result = await handleAction(action, params || {}); ws.send(JSON.stringify({ id, success: true, result })); } catch (error) { console.error('❌ 执行错误:', error); ws.send(JSON.stringify({ id: JSON.parse(message).id, success: false, error: error.message })); } }); ws.on('close', () => { console.log('🔌 客户端断开连接'); }); }); ``` ### Technical Analysis The WebSocket server accepts connections without authenticating the client, checking authorization, or validating the WebSocket `Origin` header. Constructing `WebSocket.Server` with only a port does not explicitly restrict the listener to the loopback interface, despite the documentation presenting the service as a localhost endpoint. Every connected client receives access to the same shared Chromium instance and page. Available actions include navigation, screenshots, DOM extraction, clicking, typing, and `ev ...[truncated 1883 chars]- Remediation
View remediation