Executive Summary

This vulnerability exists in the Microsoft UFO open-source framework for intelligent automation. Specifically, in version 3.0.1-4-ge2626659, the WebSocket control plane trusts client-supplied identity and role fields in task messages without proper verification.

An authenticated WebSocket client can initially register as a normal device but later send a task message claiming a higher-privilege role ("constellation") and specify a target device ID. The server incorrectly trusts these role and target values from the message instead of enforcing the role assigned during connection registration.

As a result, an attacker with the shared server token can spoof a higher-privilege role and dispatch malicious tasks to other connected devices. Additionally, the client registry allows duplicate client_id registration, which can overwrite an existing live client's stored websocket, role, and task protocol, leading to peer task hijacking.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized task execution on connected devices by an attacker who spoofs a higher-privilege role.

An attacker can hijack peer tasks, potentially disrupting device operations, compromising device integrity, and causing denial of service or unauthorized actions.

Because the attacker must be an authenticated WebSocket client with the shared server token, the vulnerability allows privilege escalation and control over other devices within the system.

Useful 0 Not Useful 0