Executive Summary

This vulnerability exists in the DirectorServer WebSocket server component of the Textream macOS teleprompter app prior to version 1.5.1. The server does not limit the number of concurrent WebSocket connections, allowing an attacker to open many connections simultaneously.

Because the server broadcasts state updates to all connected clients every 100 milliseconds, having a large number of connections causes the server to perform a very high number of send operations on the main thread. This saturates CPU and memory resources, leading to the application freezing and eventually crashing during live sessions.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability by flooding the DirectorServer with a large number of WebSocket connections, which exhausts CPU and memory resources.

This resource exhaustion causes the Textream application to freeze and crash, resulting in denial of service during live teleprompter sessions.

The impact is a loss of availability of the application, disrupting its intended use.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the number of concurrent WebSocket connections to the DirectorServer component of the Textream application. An unusually high number of WebSocket connections, especially thousands, may indicate an ongoing attack exploiting this vulnerability.

Additionally, observing high CPU and memory usage on the system running Textream during live sessions can be a sign of exploitation, as the server broadcasts state updates every 100 ms to all connected clients, causing resource exhaustion.

Suggested commands to detect this condition include:

• Use network monitoring tools to count WebSocket connections on the relevant port (e.g., using netstat or lsof):
• `netstat -an | grep ESTABLISHED | grep <Textream_port>` to list established connections.
• `lsof -i :<Textream_port>` to list open connections on the Textream port.
• Use system monitoring tools to check CPU and memory usage:
• `top` or `htop` to monitor CPU and memory usage in real time.
• `ps aux | grep Textream` to check resource usage by the Textream process.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Textream application to version 1.5.1 or later, where the vulnerability is fixed by enforcing a maximum limit of 5 concurrent WebSocket connections.

If upgrading is not immediately possible, consider limiting the number of concurrent WebSocket connections at the network or firewall level to prevent resource exhaustion.

Additional mitigation includes monitoring and blocking suspicious IP addresses that open excessive WebSocket connections.

The patch also improves broadcast efficiency and restricts broadcasts to authenticated clients, so applying the official fix is the most effective solution.

Useful 0 Not Useful 0