2260
Scope Impact Likelihood
the identity of the victim, the scope of the CSRF is limited
only by the victim's privileges.
Potential Mitigations
Phase: Implementation
Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket
handshake.
Phase: Implementation
Use a randomized CSRF token to verify requests.
Phase: Implementation
Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
Phase: Architecture and Design
Phase: Implementation
Require user authentication prior to the WebSocket connection being established. For example,
the WS library in Node has a 'verifyClient' function.
Phase: Implementation
Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with
this.
Effectiveness = Defense in Depth
Phase: Implementation
Use a library that provides restriction of the payload size. For example, WS library for Node
includes 'maxPayloadoption' that can be set.
Effectiveness = Defense in Depth
Phase: Implementation
Treat data/input as untrusted in both directions and apply the same data/input sanitization as
XSS, SQLi, etc.
Observed Examples
Reference Description
CVE-2020-25095 web console for SIEM product does not check Origin header, allowing Cross
Site WebSocket Hijacking (CSWH)
https://www.cve.org/CVERecord?id=CVE-2020-25095
CVE-2018-6651 Chain: gaming client attempts to validate the Origin header, but only uses a
substring, allowing Cross-Site WebSocket hijacking by forcing requests from
an origin whose hostname is a substring of the valid origin.
https://www.cve.org/CVERecord?id=CVE-2018-6651
CVE-2018-14730 WebSocket server does not check the origin of requests, allowing attackers to
steal developer's code using a ws://127.0.0.1:3123/ connection.
https://www.cve.org/CVERecord?id=CVE-2018-14730
CVE-2018-14731 WebSocket server does not check the origin of requests, allowing attackers to
steal developer's code using a ws://127.0.0.1/ connection to a randomized port
number.
https://www.cve.org/CVERecord?id=CVE-2018-14731
CVE-2018-14732 WebSocket server does not check the origin of requests, allowing attackers to
steal developer's code using a ws://127.0.0.1:8080/ connection.
https://www.cve.org/CVERecord?id=CVE-2018-14732
MemberOf Relationships
CWE Version 4.14
CWE-1386: Insecure Operation on Windows Junction / Mount Point
CWE-1386: Insecure Operation on Windows Junction / Mount Point