What happened
A security flaw has been identified in versions of OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. The vulnerability resides in the function <code>ConnectionManager.connect</code> within the <code>im_server/app.py</code> component, specifically related to WebSocket connection handling. Manipulating the <code>agent_name</code> argument in this function allows an attacker to bypass authentication mechanisms. This flaw can be exploited remotely without requiring any prior access or user interaction. As a result, attackers may establish unauthenticated connections, potentially leading to further malicious activities. The exploit has been publicly released and is confirmed to be actively exploited in the wild, suggesting a significant risk to affected deployments. The vulnerability is associated with CWE-287 and CWE-306, involving insecure authentication and access control. The impact is considered partial on confidentiality, integrity, and availability, as the vulnerability enables attackers to interact with the service without proper authentication. The affected product follows a rolling release approach, which means precise version details for patched or updated releases are not available. The vendor has been notified of the issue early through an issue report; however, no response or fix information has been provided at this time. The exploit's presence before the flaw was publicly disclosed classifies this as a zero-day vulnerability. No specific patch or fix status has been stated, so organisations should monitor vendor advisories for updates and instructions related to fixed versions.
Who is affected
Organisations running OpenBMB Internet of Agents versions up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a are affected. The vulnerability influences deployments that offer accessible network services, particularly those that do not implement sufficient network segmentation or access controls around the affected WebSocket connection management. No information suggests that the flaw is limited by specific environments or asset types, so any affected deployment exposed to the internet is at risk. Active exploitation indicates that malicious actors are taking advantage of the vulnerability to compromise vulnerable systems.
Recommended actions
- Apply network-level access controls to restrict external access to the affected WebSocket service.
- Restrict traffic to the WebSocket service to only trusted networks or users where possible.
- Monitor network traffic and logs for abnormal connection attempts or activity indicative of exploitation.
- Review and implement additional authentication or security measures to verify client identities for WebSocket connections.
