The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

WebSockets provide a bi-directional low latency communication (near real-time) between a client and a server. WebSockets are different than HTTP in that the connections are long-lived, as the channel will remain open until the client or the server is ready to send the message, whereas in HTTP, once the response occurs (which typically happens immediately), the transaction completes.
A WebSocket can leverage the existing HTTP protocol over ports 80 and 443, but it is not limited to HTTP. WebSockets can make cross-origin requests that are not restricted by browser-based protection mechanisms such as the Same Origin Policy (SOP) or Cross-Origin Resource Sharing (CORS). Without explicit origin validation, this makes CSRF attacks more powerful.

Primary

Cross-Site WebSocket hijacking (CSWSH)
this term is used for attacks that exploit this weakness

Architecture and Design

Implementation

Confidentiality
Integrity
Availability
Non-Repudiation
Access Control
Varies by Context
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Read Application Data
Modify Application Data
DoS: Crash, Exit, or Restart
The consequences will vary depending on the nature of the functionality that is vulnerable to CSRF. An attacker could effectively perform any operations as the victim. If the victim is an administrator or privileged user, the consequences may include obtaining complete control over the web application - deleting or stealing data, uninstalling the product, or using it to launch other attacks against all of the product's users. Because the attacker has the identity of the victim, the scope of the CSRF is limited only by the victim's privileges.

Implementation
Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.

Implementation
Use a randomized CSRF token to verify requests.

Implementation
Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.

Architecture and Design
Implementation
Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.

Implementation
Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
Defense in Depth

Implementation
Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
Defense in Depth

Implementation
Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.

CVE-2020-25095
web console for SIEM product does not check Origin header, allowing Cross Site WebSocket Hijacking (CSWH)
https://www.cve.org/CVERecord?id=CVE-2020-25095

CVE-2018-6651
Chain: gaming client attempts to validate the Origin header, but only uses a substring, allowing Cross-Site WebSocket hijacking by forcing requests from an origin whose hostname is a substring of the valid origin.
https://www.cve.org/CVERecord?id=CVE-2018-6651

CVE-2018-14730
WebSocket server does not check the origin of requests, allowing attackers to steal developer's code using a ws://127.0.0.1:3123/ connection.
https://www.cve.org/CVERecord?id=CVE-2018-14730

CVE-2018-14731
WebSocket server does not check the origin of requests, allowing attackers to steal developer's code using a ws://127.0.0.1/ connection to a randomized port number.
https://www.cve.org/CVERecord?id=CVE-2018-14731

CVE-2018-14732
WebSocket server does not check the origin of requests, allowing attackers to steal developer's code using a ws://127.0.0.1:8080/ connection.
https://www.cve.org/CVERecord?id=CVE-2018-14732

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Anonymous External Contributor
2021-05-28
4.7
2022-04-28

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated References, Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-09-09
4.18
2025-09-09
updated References

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities