PT-2024-1978 · Unknown · Meshcentral
Ylianst
·
Published
2024-02-20
·
Updated
2025-01-16
·
CVE-2024-26135
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MeshCentral versions prior to 1.1.21
Description
The issue is a cross-site websocket hijacking (CSWSH) vulnerability within the "control.ashx" endpoint, which is the primary mechanism used to perform administrative actions on the server. This vulnerability can be exploited when an attacker convinces a victim to click on a malicious link, allowing the attacker to originate a cross-site websocket connection using client-side JavaScript code. The attacker can then connect to "control.ashx" as the victim user within MeshCentral. The vulnerability is patched in version 1.1.21.
Recommendations
To remediate this vulnerability, inspect the origin header when websocket connections are established to "control.ashx" and other websocket endpoints. Verify that the origin header sent to the server matches an allowlisted origin. This would prevent an attacker from originating a cross-site websocket connection from an untrusted site.
For versions prior to 1.1.21, update to version 1.1.21 or later to patch the issue.
As a temporary workaround, consider restricting access to the "control.ashx" endpoint to minimize the risk of exploitation.
Exploit
Fix
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Meshcentral