Description (CNA)
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page that opens a WebSocket to the loopback dashboard and exfiltrates agent IDs, roles, task descriptions, and token budgets.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jovancoding / Network-AI | affected 5.0.0 before 5.15.2; unaffected 5.15.2 |
CWE
CWE-1385
References
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-hr6v-mfxm-4438
- https://www.vulncheck.com/advisories/network-ai-5.0.0-before-5.15.2-cross-site-websocket-hijacking-via-dashboardserver
ADP enrichment
No English description supplied.