Executive brief
droppy is a Node.js file-sharing and management application. The affected versions lack CSRF validation on WebSocket connections, allowing an attacker to trick a user into visiting a malicious page that silently establishes a WebSocket connection to droppy on their behalf. This enables the attacker to perform unauthorized actions such as creating admin accounts or deleting files without the user's knowledge or consent.
Technical details
The vulnerability is a cross-site socket forgery (CSRF) flaw in the WebSocket implementation. droppy fails to validate the origin of cross-domain WebSocket requests, violating the same-origin policy. An attacker can craft a malicious webpage that, when visited by a user who is authenticated to a droppy instance, establishes a WebSocket connection to that instance and executes commands with the user's privileges. No authentication bypass or special network access is required—exploitation requires only that the victim visit the attacker's page while authenticated to droppy. The vulnerability was patched in version 3.5.0.
Affected products
- droppy droppy < 3.5.0
Timeline
- 2019-02-18: disclosed
- 2019-02-18: patched: Version 3.5.0 released