Articles & Blogs

WebSocket Vulnerabilities: Keep Your WebSocket Connection Safe

February 20, 2023 | By Accorian

WebSocket is a powerful tool for sending and receiving messages over a network. It enables quick and reliable data exchange by establishing two-way communication between the server and the client. It is used in everything from online gaming to real-time data streaming.

Unfortunately, WebSocket only comes with flaws. Cross-Site WebSocket Hijacking (CSWSH) is a security threat that allows malicious actors to hijack a legitimate WebSocket connection, allowing them to intercept, modify, delete, and inject data. They are also vulnerable to Denial-of-Service attacks, which can prevent legitimate users from accessing the network. WebSocket can also perform man-in-the-middle attacks, allowing attackers to modify or inject data into the network without the user’s knowledge.

Here’s everything you need to know about WebSocket!

What is WebSocket?

WebSocket allows two-way communication between a website and its server in real-time. It is a protocol that allows the client and server to transmit messages over the channel at the same time. They’re used for things like chat apps and updating information on a website without having to refresh the page.

The WebSocket-based connection lasts as long as either party lays it off. When one party terminates the connection, the second party can no longer communicate since the link is automatically terminated.

WebSocket, like HTTP, can be either encrypted or unencrypted, as defined by the WebSocket schemes ws and wss, where ws:// is an unencrypted WebSocket, and wss:// is an encrypted WebSocket over TLS.

They act as a backdoor connection between your computer and the website. Instead of waiting for the website to send you information, you can ask for it and receive it immediately, and the website can also send you information without requiring you to refresh the page. It’s like a two-way phone call in which you and the website can converse simultaneously.

How Does WebSocket Work?

The usual WebSocket interaction between client and server consists of the following steps:

What are the Common WebSocket Vulnerabilities?

Improper WebSocket implementation can lead to serious vulnerabilities. Some of the most common security flaws are:

1. Cross-Site WebSocket Hijacking (CSRF with WebSockets)

If the WebSocket handshake relies on HTTP cookies for the session and does not include a Cross-Site Request Forgery (CSRF) token, an attacker can write a custom script on their domain to establish a cross-site WebSocket connection to the vulnerable application. Using this attack approach, an attacker might obtain sensitive information.

You can find a common script below that can be used to exploit this vulnerability:

2. Unencrypted Communications

A WebSocket, like HTTP, can be encrypted or unencrypted. It utilizes the WebSocket schemes ws and wss to differentiate between the two. In particular, ws:// represents an unencrypted WebSocket, whereas wss:// represents a WebSocket encrypted with Transport Layer Security (TLS).

3. Denial of Service

The server may receive an endless number of connections via WebSocket. This allows an attacker to perform a denial-of-service attack against the server, which significantly strains the server and consumes all its resources, thus delaying communication.

The script below frequently crashes the WebSocket server, affecting some versions of the WebSocket client:

4. Sensitive Information Disclosure

This occurs when WebSocket fails to protect confidential information adequately and may allow unauthorized access to such information. Passwords, credit card information, private communications, and intellectual property are examples of sensitive data. Additionally, this type of security flaw can be vulnerable to various services and systems, including databases, operating systems, and network devices.

5. Input-Validation Vulnerabilities

If an attacker has access to WebSocket communications and the server does not properly validate or sanitize the input, an injection attack may occur. An attacker, for example, can deliver specially crafted payloads as messages while bypassing client-side validation by utilizing a proxy tool such as BurpSuite. Furthermore, attackers can launch attacks if the server does not validate the input for special characters or malicious data.

Let’s assume we’re testing a chat application that uses WebSocket. The system will transmit a message in the following format when a user types it:

In the absence of input validation, an attacker can intercept the request using a web proxy (Burp, in this example) to trigger an XSS pop-up by replacing their payload:

How Can you Ensure Your WebSocket is Safe?

You can use the following approach to avoid WebSocket Vulnerabilities:

• Make use of the wss:/ protocol (WebSockets over TLS).
• Hard code the URL of the WebSockets endpoint, and don’t include any user-controllable data.
• Avoid cross-site WebSocket hijacking vulnerabilities by protecting the WebSocket handshake message from CSRF.
• Avoid input-based vulnerabilities like SQL injection and cross-site scripting, and handle data properly on both the server and client sides.

Conclusion

The WebSocket industry is constantly evolving, and so are its security vulnerabilities. One thing to keep in mind is that not every WebSocket is vulnerable. However, if a WebSocket vulnerability is identified, address it immediately. Furthermore, organizations dealing with WebSocket must be extremely cautious and understand the need to implement all WebSocket security controls.

Accorian’s Pentesting Procedure

1. Data Collection

There are a variety of data collecting techniques, including Google Search, for acquiring data from a target system. In addition to web page source code analysis, various unrestricted tools and services are available on the market that gives information such as databases, table names, system software, and hardware used by third-party plugins.

2. Vulnerability Evaluation

Security flaws in the target network may be readily recognized based on the data acquired in the first stage. This allows penetration testers to perform attacks utilizing the system’s recognized entry points.

3. Practical Exploitation

Starting an assault on the target system is the most crucial phase, and it requires specialized expertise and procedures. Expert penetration testers may start an attack on a system using their talents.

4. Analysis of Results and Production of Reports

After conducting penetration testing, compile comprehensive reports for remedial measures. In these reports, all detected vulnerabilities and proposed remediation procedures are detailed. You may modify the format of vulnerability reports (XML, HTML, Microsoft Word, PDF) to meet the demands of your company.

The Accorian Advantage

In addition to penetration testing, Accorian can also recommend solutions or compensatory controls for identified vulnerabilities. Moreover, we can conduct penetration testing and map vulnerabilities to various compliance criteria to aid in prioritizing solutions. By doing so, we help customers understand the overall security posture of the environment.

Recent Blog

Article

Adobe's Common Controls Framework of Industry-acclaimed security standards

Today’s world is an ever-changing scenario with changes to the technology sector happening more frequently than ever due to emerging technologies. The case is quite similar in the field of Cyber Security. There are a few industry-acclaimed cybersecurity standards for governing the processes and execution of these standards. These standards are usually built upon a framework of control objectives that need to be implemented by the organizations to comply with these standards. Compliance is measured in terms of control objectives meeting the compliance criteria and also other regulatory and statutory criteria. Since most of these Cybersecurity standards speak of similar control objectives or lay emphasis on similar control areas, it is advisable to have the ‘Adobe’s Common Control Framework’, which means that if we are able to comply with a single requirement from a particular framework, in theory, we should be able to use the adherence of that requirement for ALL the similar frameworks. There are several approaches to achieving this Adobe's Common Controls Framework both in theory and in practice and will be discussed in detail later on in this article. The most relevant security and privacy frameworks are ISO 27001, NIST, PCIDSS, GDPR, SOC Type 2. There is a significant overlap of controls contained in these standards as all of these standards primarily deal with one requirement which is the protection of data. Protection of information from unauthorized disclosure, compromise, and theft forms the backbone or the building blocks of an Adobe's Common Control Framework. This leverages the fact that similar controls or that the essence of the controls is the same across standards and can be used to gauge the adherence or compliance of an organization to the standard. In actual execution, while gauging the compliance of an organization, the Adobe's Common Controls Framework is not only holistic but can reduce the effort and cost otherwise required by the organization to comply with individual standards. There are two methods of developing the Adobe's Common Control Framework for an organization and there are very subtle differences between the two methods. They are Controls harmonization and Controls Mapping. Controls Harmonization: Harmonization is the creation of a brand-new control language set from several source languages of standards taking into consideration content & context. In theory, the intent and meaning of the words and sentences remain intact, but the language and actual words of the individual standards have been changed with a new harmonized meaning defined. To achieve the usage of a single language as an industry, globally, it would have significant benefits and it would be the most efficient way to operate not only as security professionals but also as humans. Adobe’s Common Control Framework is an example of this type of construct. The benefits of having a single operating language can truly be amazing in terms of effort reduction and cost reduction. Control Mapping: Today, most brilliant and forward-thinking security professionals are using the control mapping method. The main idea behind this method is to keep the original language intact as much as possible while mapping and matching the intent and meaning of each sentence and word. This is the most practical and realistic approach because this is how humans fundamentally interact with each other globally. One can see this working in real life where two different languages are being spoken by individuals and kept mainly intact, but an interpreter or linguist is translating between the two — the map is developed in the mind of the linguist. Some real-life examples of mapping for cybersecurity frameworks can be seen in HITRUST Framework, Cloud Security Alliance Framework, and even the U.S. Government formally...

Article

Risk Management Framework – Managing & Measuring what matters

A risk management program allows you to manage overall information security risk. It is an approach to identify, quantify, mitigate, and monitor risks. The reason to look at risk in a comprehensive manner is to make sure no one area is getting too much attention or, too little. Frameworks also help you identify the bigger elements of risk that need review and mitigation. Additionally, it help you to prioritize the treatment of certain risks. The adherence to risk frameworks also helps give your customers comfort that a standard risk management is in place and hence, reduce your audit burden. Typically, a Risk Management program comprises of the following phases: Risk identification Risk analysis Risk evaluation Risk treatment Risk Monitoring A good risk management framework will have the following characteristics: Comprehensive in types of risks it covers Practical for an organization to implement Updated with current real-world risks Based on controls that can be reviewed and audited Reliable so that your vendors and customers can accept it There are many risk management frameworks that one can choose from and it important to understand the advantages of each. Common risk management frameworks include: NIST CSF SOC 2 ISO 27001 HITRUST NIST (National Institute of Standards and Technology) framework is a comprehensive cybersecurity framework (CSF). It is very widely accepted across different company sizes and business domains. Most cyber-security professionals are well aware of this framework as it is readily available. Although widely available and very popular there is no certified third-party audit mechanism. Hence, it can only be self-assessed. SOC 2 Type 2 is an internal controls report based on the scope you define. It is widely used in the United States to show the maturity of your controls. A CPA firm that is part of the American Institute of CPAs (AICPA) conducts the audit & issues an assessment report. The AICPA does not audit/review the assessment for completeness or quality. HITRUST CSF is a framework that came leverages NIST, SOC, and ISO along with others to create a more comprehensive standard. It is widely implemented in the United States by organisations in the healthcare space. Unlike others, although there are external assessors that are involved in the certification process, HITRUST reviews all assessments and issues the certificate. Additionally, among all the frameworks above it tends to be the most expensive to implement. It is important to choose a framework that matches your long-term security goals & needs. At Accorian, we work with all of the above frameworks. We help organizations choose the right framework and aid with the implementation. This is done by augmenting our team into your security team to help steer the rollout, aid with query resolution, choosing of the right controls & workaround during mitigation advisory, facilitating the selection of vendors & products and end to end program management.

Articles & Blogs

WebSocket Vulnerabilities: Keep Your WebSocket Connection Safe

What is WebSocket?

How Does WebSocket Work?