CVE-2024-26135: MeshCentral cross-site websocket hijacking in control.ashx

CVE-2024-26135 · Severity: low · CVSS 3 · Published 2024-02-21

MeshCentral is a remote management and control platform used to administer servers and devices. A cross-site websocket hijacking vulnerability in its control.ashx endpoint allows an attacker to hijack an authenticated administrator's session by tricking them into visiting a malicious site, potentially enabling unauthorized administrative actions, secret leakage, and token generation. The attack requires specific conditions such as subdomain compromise or XSS, but when successful can lead to complete platform compromise.

Vendors: npm.

Quick answers

Is CVE-2024-26135 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-26135 being exploited in the wild.
How severe is CVE-2024-26135?
Low severity, with a CVSS score of 3, published 21 February 2024.
Which products and versions are affected?
meshcentral (npm) SEMVER:introduced=0,fixed=1.1.21.
Is there a fix for CVE-2024-26135?
Yes. meshcentral (npm): upgrade to 1.1.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-26135 attacked?
It is attacked over the network.
Am I affected by CVE-2024-26135?
Check whether you run meshcentral (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • meshcentral (npm): upgrade to 1.1.21 or later
    npm install meshcentral@1.1.21

Technical details

The vulnerability is a cross-site websocket hijacking (CSWSH) flaw in the control.ashx endpoint, which is MeshCentral's primary administrative interface. The endpoint lacks proper origin validation for websocket connections, allowing an attacker-controlled origin to establish a websocket connection to the victim's authenticated session. An attacker must convince a logged-in user to visit an attacker-controlled page (via a malicious link) or exploit a nearby subdomain takeover or XSS vulnerability on the same parent domain. The SameSite=Lax cookie setting provides partial mitigation by blocking cross-domain exploitation, but does not prevent same-domain or subdomain attacks. A successful exploit can read the server configuration file, leak the sessionKey variable, generate login tokens, and forge authentication cookies. The patch is available in version 1.1.21 and later.

Affected products

  • MeshCentral MeshCentral before 1.1.21

Identifiers

  • CVE-2024-26135
  • GHSA-cp68-qrhr-g9h8

Timeline

  • 2024-02-19: disclosed
  • 2024-02-19: patched: Fixed in version 1.1.21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.