CVE-2023-30856
📋 TL;DR
CVE-2023-30856 is a cross-site WebSocket hijacking vulnerability in eDEX-UI terminal emulator versions 2.2.8 and earlier. When users run eDEX-UI while browsing the web, malicious websites can connect to the terminal's internal WebSocket and execute arbitrary shell commands. This affects all users of vulnerable eDEX-UI versions who browse the web while the application is running.
💻 Affected Systems
- eDEX-UI
📦 What is this software?
Edex Ui by Edex Ui Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary command execution with the privileges of the eDEX-UI process, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious websites executing commands to steal sensitive data, install malware, or pivot to other systems on the network.
If Mitigated
Limited impact if eDEX-UI runs with minimal privileges and users avoid browsing untrusted sites while it's active.
🎯 Exploit Status
Exploitation requires user to visit malicious website while eDEX-UI is running. No authentication needed to connect to WebSocket.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9
Restart Required: No
Instructions:
No official patch available. Project archived since 2021 with no plans for updates.
🔧 Temporary Workarounds
Disable eDEX-UI while browsing
allCompletely shut down eDEX-UI before browsing the web or visiting untrusted sites.
Run with minimal privileges
allConfigure eDEX-UI to run with lowest possible user privileges to limit potential damage.
sudo -u nobody edex-ui
runas /user:guest edex-ui.exe
🧯 If You Can't Patch
- Discontinue use of eDEX-UI and switch to alternative terminal emulators
- Use browser extensions to block WebSocket connections from untrusted sites
🔍 How to Verify
Check if Vulnerable:
Check eDEX-UI version. If version is 2.2.8 or earlier, you are vulnerable.Check Version:
Check About section in eDEX-UI or examine package metadataVerify Fix Applied:
No fix available to verify. Only workarounds can be implemented.📡 Detection & Monitoring
Log Indicators:
- Unexpected WebSocket connections to eDEX-UI port
- Unusual command execution in terminal logs
Network Indicators:
- WebSocket traffic from browser processes to eDEX-UI port
- Cross-origin WebSocket requests
SIEM Query:
websocket AND (destination_port:port_number OR process_name:edex-ui)🔗 References
- https://christian-schneider.net/CrossSiteWebSocketHijacking.html
- https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458
- https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9
- https://christian-schneider.net/CrossSiteWebSocketHijacking.html
- https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458
- https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9
