| शीर्षक | facil.io <= 0.7.4 Improper Input Validation |
|---|
| विवरण | A remote client can send a malformed WebSocket data frame with the MASK bit set to 0, violating RFC 6455 requirements for client-to-server WebSocket communication. Although the server detects this protocol violation and eventually closes the connection, the payload is still delivered to the application-level handler on_message before the socket is terminated.
The root cause is a control-flow issue in the WebSocket frame parsing logic. When an unmasked frame is detected, the parser triggers a protocol error via websocket_on_protocol_error, but execution does not stop at that point. Instead, it continues into the opcode dispatch logic, eventually reaching websocket_on_unwrapped, which directly invokes the application callback ws->on_message. The connection is only closed later in the error handling stage, after the message has already been processed by application logic.
This results in a logic bypass condition where protocol-invalid WebSocket frames are still able to trigger application behavior once per connection. Any service that relies on on_message for state changes, command execution, or side effects may be affected, depending on application logic design.
The issue has been reproduced on the current development branch (HEAD: 5128747363055201d3ecf0e29bf0a961703c9fa0) using default WebSocket configuration. A proof-of-concept demonstrates that sending an unmasked frame after a valid handshake results in the payload being processed before the connection is closed.
Impact is application-dependent but may include unintended state transitions, unauthorized actions, or other side effects triggered by malformed input. The vulnerability is remotely exploitable without authentication, requiring only network access to an exposed WebSocket endpoint.
Affected product: facil.io
Affected versions: 0.7.4 and earlier
No patch is currently available.
Severity: Medium (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Weakness classification: CWE-20 Improper Input Validation
We attempted to report this issue via a GitHub Security Advisory submission to the upstream repository. However, there has been no response from the maintainers, and multiple email attempts to the project maintainers have also received no reply. As a result, we are now requesting CVE assignment through VulDB due to lack of upstream response and absence of any security coordination from the vendor. |
|---|
| स्रोत | ⚠️ https://github.com/boazsegev/facil.io/issues/169 |
|---|
| उपयोगकर्ता | Fantasy_2026 (UID 98691) |
|---|
| सबमिशन | 17/06/2026 05:04 AM (1 महीना पहले) |
|---|
| संयम | 22/07/2026 06:13 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 382382 [boazsegev facil.io तक 0.7.4 WebSocket Frame Parser websocket_parser.h websocket_on_protocol_error on_message अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|