Taipy Socket.io Server CORS Misconfiguration Enables Credentialed WebSocket Attacks

Executive Summary

This vulnerability is a Cross-Site WebSocket Hijacking (CSWSH) flaw in Taipy versions up to 4.1.1. The socket.io server is configured with a wildcard CORS origin and credential flag enabled, allowing any website to establish authenticated WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications or action callbacks without CSRF protection.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Taipy server configurations for wildcard CORS origins in socket.io settings. Check server.py or configuration files for cors_allowed_origins='*' and Access-Control-Allow-Credentials=true. Monitor network traffic for unauthorized WebSocket connections from external domains.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this to connect to your Taipy application using your session cookies, read and write state variables, trigger callbacks, initiate file downloads, and exfiltrate application data without your knowledge. The attack requires no additional authentication beyond your existing session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized disclosures, and non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Taipy to a patched version beyond 4.1.1. Disable wildcard CORS origins by setting cors_allowed_origins to specific trusted domains. Disable credentialed WebSocket connections unless absolutely necessary. Implement CSRF protection for state modifications and action callbacks.

Useful 0 Not Useful 0