CWE-1385
AllowedMissing Origin Validation in WebSockets
Abstraction: Variant · Status: Incomplete
The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
61 vulnerabilities reference this CWE, most recent first.
GHSA-XG8J-J6VP-6H5W
Vulnerability from github – Published: 2025-08-03 12:30 – Updated: 2025-11-05 20:34Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.
Users are recommended to upgrade to version 0.12.0, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.zeppelin:zeppelin-shell"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.1"
},
{
"fixed": "0.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-51775"
],
"database_specific": {
"cwe_ids": [
"CWE-1385"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-04T16:39:35Z",
"nvd_published_at": "2025-08-03T11:15:26Z",
"severity": "MODERATE"
},
"details": "Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.\n\nThe attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs.\u00a0\nThis issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.\n\nUsers are recommended to upgrade to version 0.12.0, which fixes the issue.",
"id": "GHSA-xg8j-j6vp-6h5w",
"modified": "2025-11-05T20:34:05Z",
"published": "2025-08-03T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51775"
},
{
"type": "WEB",
"url": "https://github.com/apache/zeppelin/pull/4823"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/zeppelin"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/08/03/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability"
}
Mitigation
Enable CORS-like access restrictions by verifying the 'Origin' header during the WebSocket handshake.
Mitigation
Use a randomized CSRF token to verify requests.
Mitigation
Use TLS to securely communicate using 'wss' (WebSocket Secure) instead of 'ws'.
Mitigation
Require user authentication prior to the WebSocket connection being established. For example, the WS library in Node has a 'verifyClient' function.
Mitigation
Leverage rate limiting to prevent against DoS. Use of the leaky bucket algorithm can help with this.
Mitigation
Use a library that provides restriction of the payload size. For example, WS library for Node includes 'maxPayloadoption' that can be set.
Mitigation
Treat data/input as untrusted in both directions and apply the same data/input sanitization as XSS, SQLi, etc.
No CAPEC attack patterns related to this CWE.