fix(security): validate Origin header on WebSocket /run_live endpoint#4943
fix(security): validate Origin header on WebSocket /run_live endpoint#4943luskabolas wants to merge 1 commit intogoogle:mainfrom
Conversation
The /run_live WebSocket endpoint does not validate the Origin header, allowing a malicious webpage to establish cross-origin WebSocket connections to the local dev server. Combined with the ability to upload agent files via /builder/save (which uses simple POST requests that bypass CORS preflight), this enables a CSRF-to-RCE attack chain where an attacker's page can upload a malicious agent and trigger its execution via WebSocket. Add server-side Origin validation on the /run_live WebSocket handler. The allowed origins are derived from the server's host/port and any user-provided --allow_origins values. This prevents cross-origin WebSocket hijacking while preserving legitimate same-origin access.
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
Response from ADK Triaging Agent Hello @luskabolas, thank you for creating this PR! Before we can merge this PR, you'll need to sign our Contributor License Agreement (CLA). You can do so at https://cla.developers.google.com/. Additionally, this PR is a bug fix. Could you please associate a GitHub issue with this PR? If there is no existing issue, could you please create one? This information will help us to review your PR more efficiently. Thanks! |
|
@googlebot I signed it. |
2 participants
Summary
/run_liveWebSocket endpoint does not validate theOriginheader, allowing cross-origin WebSocket connections from any webpage/builder/save(CORS-exempt simple POST) and trigger its execution through the WebSocket, achieving remote code executionhost/portand any user-provided--allow_originsvaluesTest plan
test_ws_rejects_cross_origin— foreign origin is closed with code 1008test_ws_allows_same_origin— server's own origin is not rejected