T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.js:93- Finding
Unauthenticated WebSocket Endpoint Exposes Full Browser Control
- Content
View full analysis
{ console.log('🔌 新的客户端连接'); ``` ### Technical Analysis The WebSocket server is created with only a port number. It does not explicitly bind to `127.0.0.1`, so it may listen on all available network interfaces. The console message and documentation describe the service as running on localhost, but the implementation does not enforce that restriction. The connection handler performs no authentication, authorization, token validation, client-origin validation, or connection-level permission checks. Once connected, a client can invoke every supported browser action. The browser and active page are also stored in global variables, meaning all clients operate on the same browser session. An unauthorized client can therefore interact with pages opened by a legitimate user, including pages containing authenticated sessions. ### Attack Path 1. An attacker identifies a host exposing TCP port `18790`. 2. The attacker establishes a WebSocket connection without supplying credentials. 3. The attacker sends `status`, `snapshot`, or `screenshot` requests to inspect the active browser. 4. The attacker uses `navigate`, `click`, `type`, or `evaluate` to manipulate the shared browser session. 5. If the browser contains an authenticated session, the attacker performs actions with the victim's web application privileges. ### Impact Assessment A network-reachable attacker can obtain complete control over the shared browser session. This may permit: - Reading data displayed in authenticated web applications. - Extracting form values and page contents. - Capturing screenshots. - Performing transactions or changing a ...[truncated 263 chars]- Remediation
View remediation