CyberSecBulletin
CVE-2024-23168NVD status: Deferred

xsoverlay: Missing Origin Validation in WebSockets

Published Updated By the CyberSecBulletin desk

CVE-2024-23168 is a critical-severity missing origin validation in websockets vulnerability in xsoverlay from Xiexe, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 647 as the first without the flaw, so updating xsoverlay to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.4% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update xsoverlay to 647 or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Xiexexsoverlaybefore 647647

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).

Official description

Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Origin Validation in WebSockets

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

How developers prevent this class of flaw

  • Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
  • Use a randomized CSRF token to verify requests.
  • Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.

More Missing Origin Validation in WebSockets vulnerabilities (CWE-1385)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Spotted an error? Tell us.