Arbitrary File Read in DeepWiki-Open via Unauthenticated WebSocket

Executive Summary

DeepWiki-Open has an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint. It accepts repo_url as a filesystem path without proper containment, allowing attackers to read files with supported extensions like Python, JavaScript, YAML, and JSON that may contain hardcoded secrets or credentials.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the /ws/chat WebSocket endpoint by monitoring network traffic for requests containing the repo_url parameter. Look for file read attempts with suspicious paths like /etc/passwd or sensitive file extensions (py, js, yaml, json).

Use tools like curl to test the endpoint: curl -i -s -k -X GET "http://<target>/ws/chat?repo_url=/etc/passwd". If the server responds with file contents, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to read sensitive files on the server, including configuration files, source code, or files containing credentials. This could lead to data breaches, unauthorized access, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the /ws/chat WebSocket endpoint immediately if it is not required. Implement strict input validation for the repo_url parameter to prevent directory traversal attacks.

Restrict file access permissions on the server to limit exposure of sensitive files. Update DeepWiki-Open to the latest commit or apply patches from the vendor if available.

Useful 0 Not Useful 0