CVE-2024-5820

Executive Summary

CVE-2024-5820 is a critical vulnerability in Stitionai Devika (commit ecee79f) that exposes an unprotected WebSocket connection. This allows any malicious website to connect to the backend and issue commands on behalf of the user, leading to unauthorized command execution and potential server-side request forgery (SSRF). The vulnerability has a CVSS score of 7.6, indicating high severity. No official patch is currently available, and the EPSS score is 0.0%, suggesting low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects the Stitionai Devika project, which is a Python-based AI assistant. The unprotected WebSocket connection is a critical supply chain risk, as it can be exploited by malicious websites to intercept and manipulate communications between the user and the backend. Users should monitor for updates from the vendor and consider implementing additional security controls.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

The threat level is high due to the lack of authentication required for exploitation and the potential for unauthorized command execution and SSRF.

Deep Dive & Mechanics

The vulnerability stems from an unprotected WebSocket connection in the Devika backend. The backend listens on a socket without any authentication or origin validation, allowing any website to establish a WebSocket connection. Once connected, the malicious site can send arbitrary commands to the backend, which executes them with the privileges of the user. This can lead to:

• Unauthorized command execution
• Server-side request forgery (SSRF)
• Data exfiltration
• Potential lateral movement within the network

The issue is exacerbated by the fact that the backend serves all listeners on the given socket, meaning any malicious website can intercept all communication between the user and the backend.

Vulnerable vs. Patched Code

Vulnerable Code (commit ecee79f): The vulnerable code likely lacks origin validation or authentication for WebSocket connections. For example:

# Vulnerable: No origin check or authentication
import asyncio
import websockets

async def handler(websocket, path):
    # Directly handle commands without validation
    async for message in websocket:
        # Execute command
        pass

start_server = websockets.serve(handler, "localhost", 8765)
asyncio.get_event_loop().run_until_complete(start_server)
asyncio.get_event_loop().run_forever()

Patched Code (Hypothetical): A patched version would include origin validation and authentication:

# Patched: Validate origin and require authentication
import asyncio
import websockets

ALLOWED_ORIGINS = ["https://trusted-site.com"]

async def handler(websocket, path):
    origin = websocket.request_headers.get("Origin")
    if origin not in ALLOWED_ORIGINS:
        await websocket.close(1008, "Origin not allowed")
        return
    # Authenticate user
    auth_token = await websocket.recv()
    if not validate_token(auth_token):
        await websocket.close(1008, "Authentication failed")
        return
    async for message in websocket:
        # Execute command
        pass

start_server = websockets.serve(handler, "localhost", 8765)
asyncio.get_event_loop().run_until_complete(start_server)
asyncio.get_event_loop().run_forever()

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Set up a malicious website that connects to the vulnerable WebSocket endpoint.
2. Use JavaScript to establish a WebSocket connection:

const socket = new WebSocket('ws://victim-server:8765/');
socket.onopen = function(event) {
    // Send malicious commands
    socket.send('malicious_command');
};
socket.onmessage = function(event) {
    console.log('Received:', event.data);
};

3. Issue commands to perform SSRF or execute arbitrary actions.

Lab Setup:

• Deploy a vulnerable instance of Devika (commit ecee79f) on a local network.
• Use a simple HTTP server to host the malicious website.
• Test the exploit by connecting from the malicious site.

Blue Team

Detection and Response:

• Monitor for unexpected WebSocket connections to the Devika backend.
• Implement network segmentation to isolate the Devika backend.
• Use Web Application Firewalls (WAF) to block unauthorized origins.
• Enable logging and alerting for unusual WebSocket traffic.

Honeypot:

• Deploy a honeypot that mimics the vulnerable WebSocket endpoint to detect scanning or exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • WebSocket connections to port 8765 (default) from unexpected origins.
  • Unusual command sequences in WebSocket messages.
• File IOCs:
  • Logs showing unauthorized WebSocket connections.
• Behavioral IOCs:
  • Unexpected outbound HTTP requests from the Devika backend (SSRF).
  • Unauthorized command execution on the host.

Detection Engineering

YARA Rule

rule CVE_2024_5820_WebSocket_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-5820 via WebSocket connections"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5820"
    strings:
        $ws_connect = "ws://" ascii wide nocase
        $ws_secure = "wss://" ascii wide nocase
        $cmd_exec = "command" ascii wide nocase
        $ssrf = "http://" ascii wide nocase
    condition:
        any of ($ws_connect, $ws_secure) and any of ($cmd_exec, $ssrf)
}

Sigma Rule

title: Detection of CVE-2024-5820 WebSocket Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized WebSocket connections to Devika backend
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/ws'
        sc-status: 101
    condition: selection
falsepositives:
    - Legitimate WebSocket connections from trusted origins
level: high

Suricata Rule

alert tcp any any -> any 8765 (msg:"CVE-2024-5820 - Unprotected WebSocket Connection to Devika Backend"; flow:to_server,established; content:"|16 03 01|"; depth:3; content:"|01 00|"; distance:1; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WebSocket endpoint if not required.
2. Implement origin validation for WebSocket connections.
3. Add authentication mechanisms (e.g., tokens) for WebSocket connections.
4. Restrict network access to the Devika backend using firewalls.

Long-term Fixes:

• Apply patches from the vendor when available.
• Upgrade to a secure version of Devika.
• Conduct a security audit of the application.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to validate WebSocket origins.
• Implement WebSocket authentication at the application level.

Valters IT
Securing Digital Frontiers