CWE-1385 — Vulnerability Class 25

CWE-1385 represents a critical input validation weakness where a server fails to verify the origin of incoming WebSocket connections. This flaw allows attackers to exploit the persistent, bidirectional nature of WebSockets by forging requests from malicious third-party sites, bypassing standard Same-Origin Policy protections. By tricking a victim’s browser into establishing a connection, an attacker can send unauthorized commands or exfiltrate sensitive data directly to the vulnerable server. To mitigate this risk, developers must rigorously validate the Origin header during the initial HTTP handshake that upgrades the connection to WebSocket protocol. Implementing strict origin checking ensures that only trusted domains can establish persistent communication channels, effectively preventing cross-site request forgery attacks and unauthorized data access through forged WebSocket connections.