T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- server.js:93
- Finding
- Unauthenticated WebSocket Endpoint Exposes Full Browser Control<![CDATA[ ## Vulnerability Details **File Location**: `server.js:93-98` **Vulnerability Type**: Missing authentication and network access controls **Risk Level**: Critical ### Vulnerable Code ```js // 启动 WebSocket 服务器 const wss = new WebSocket.Server({ port: PORT }); console.log(`🦞 AI Browser Server 启动在 ws://localhost:${PORT}`); wss.on('connection', (ws) => { console.log('🔌 新的客户端连接'); ``` ### Technical Analysis The WebSocket server is created with only a port number. It does not explicitly bind to `127.0.0.1`, so it may listen on all available network interfaces. The console message and documentation describe the service as running on localhost, but the implementation does not enforce that restriction. The connection handler performs no authentication, authorization, token validation, client-origin validation, or connection-level permission checks. Once connected, a client can invoke every supported browser action. The browser and active page are also stored in global variables, meaning all clients operate on the same browser session. An unauthorized client can therefore interact with pages opened by a legitimate user, including pages containing authenticated sessions. ### Attack Path 1. An attacker identifies a host exposing TCP port `18790`. 2. The attacker establishes a WebSocket connection without supplying credentials. 3. The attacker sends `status`, `snapshot`, or `screenshot` requests to inspect the active browser. 4. The attacker uses `navigate`, `click`, `type`, or `evaluate` to manipulate the shared browser session. 5. If the browser contains an authenticated session, the attacker performs actions with the victim's web application privileges. ### Impact Assessment A network-reachable attacker can obtain complete control over the shared browser session. This may permit: - Reading data displayed in authenticated web applications. - Extracting form values and page contents. - Capturing screenshots. - Performing transactions or changing a ...[truncated 263 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Explicitly bind the server to loopback unless remote operation is strictly required: ```js const wss = new WebSocket.Server({ host: '127.0.0.1', port: Number(PORT) }); ``` 2. Require a high-entropy authentication token during the WebSocket handshake. 3. Reject connections with missing or invalid credentials before registering message handlers. 4. Validate the WebSocket `Origin` header against an explicit allowlist. 5. Use TLS when any remote access is permitted. 6. Create a separate incognito browser context and page for each authenticated client. 7. Apply authorization checks per action rather than treating authentication as permission to invoke every capability. 8. Add connection limits, message-size limits, rate limiting, and security audit logging. 9. Apply host firewall rules so port `18790` is not reachable from untrusted networks. ]]>