CVE-2024-26135
📋 TL;DR
This CVE describes a cross-site websocket hijacking vulnerability in MeshCentral's control.ashx endpoint, which handles administrative actions. Attackers can exploit it by tricking users into clicking malicious links, allowing unauthorized administrative operations as the victim. All MeshCentral instances prior to version 1.1.21 are affected.
💻 Affected Systems
- MeshCentral
📦 What is this software?
Meshcentral by Meshcentral
⚠️ Risk & Real-World Impact
Worst Case
Full administrative compromise of the MeshCentral server, allowing attacker to execute arbitrary commands, access all managed systems, and potentially pivot to internal networks.
Likely Case
Unauthorized administrative actions performed on the MeshCentral server, potentially compromising managed endpoints or stealing sensitive data.
If Mitigated
Limited impact if proper network segmentation and access controls prevent administrative actions from reaching critical systems.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) and knowledge of the target MeshCentral instance URL.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.21
Vendor Advisory: https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8
Restart Required: Yes
Instructions:
1. Backup your MeshCentral configuration and data. 2. Update MeshCentral to version 1.1.21 or later using npm: 'npm install meshcentral@latest'. 3. Restart the MeshCentral service.
🔧 Temporary Workarounds
Restrict access to MeshCentral
allLimit MeshCentral access to trusted networks only using firewall rules.
Implement CSRF protection headers
allAdd Content-Security-Policy headers to restrict websocket connections.
Add to web server config: Content-Security-Policy: connect-src 'self'
🧯 If You Can't Patch
- Isolate MeshCentral server behind VPN or internal network only
- Implement strict access controls and monitor for suspicious administrative actions
🔍 How to Verify
Check if Vulnerable:
Check MeshCentral version in web interface or via command: 'meshcentral --version'Check Version:
meshcentral --versionVerify Fix Applied:
Confirm version is 1.1.21 or later and verify control.ashx endpoint now validates Origin headers📡 Detection & Monitoring
Log Indicators:
- Unauthorized websocket connections to control.ashx
- Administrative actions from unexpected IP addresses
Network Indicators:
- Cross-origin websocket requests to control.ashx endpoint
- Websocket handshakes without proper Origin headers
SIEM Query:
source="meshcentral.log" AND "control.ashx" AND "WebSocket" AND NOT origin="https://your-meshcentral-domain.com"🔗 References
- https://github.com/Ylianst/MeshCentral/commit/f2e43cc6da9f5447dbff0948e6c6024c8a315af3
- https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8
- https://github.com/Ylianst/MeshCentral/commit/f2e43cc6da9f5447dbff0948e6c6024c8a315af3
- https://github.com/Ylianst/MeshCentral/security/advisories/GHSA-cp68-qrhr-g9h8
