Network-AI DashboardServer WebSocket Hijacking Vulnerability

Executive Summary

This vulnerability is a cross-site WebSocket hijacking flaw in Network-AI's DashboardServer component. It allows attackers to trick users into visiting a malicious page that opens a WebSocket connection to the dashboard running on localhost. The server fails to validate the Origin header or tokens during the WebSocket handshake, enabling attackers to read sensitive agent topology data such as IDs, roles, task descriptions, and token budgets.

Useful 0 Not Useful 0

Detection Guidance

Check if Network-AI DashboardServer is running on localhost by inspecting open ports with commands like 'netstat -tuln | grep 4820' or 'ss -tuln | grep 4820'. Verify if WebSocket connections are accepted without authentication by monitoring network traffic or using tools like Wireshark to inspect WebSocket handshakes.

Useful 0 Not Useful 0

Impact Analysis

If you use Network-AI versions 5.0.0 to 5.15.1, an attacker could exploit this to steal sensitive data from your dashboard. This includes agent details and token budgets, which could be used for further attacks. The attack requires tricking you into visiting a malicious site while the dashboard is running.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or confidential information. Compliance may be impacted if the exfiltrated data includes regulated information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Network-AI to version 5.15.2 or later. If upgrading is not possible, restrict access to the DashboardServer by binding it to localhost only or using a firewall to block external connections. Implement Origin header validation in handleUpgrade and require authentication tokens for WebSocket and HTTP endpoints.

Useful 0 Not Useful 0