JavaScript Insecure WebSocket Connection

What it is

The JavaScript application establishes WebSocket connections using the insecure 'ws://' protocol instead of secure 'wss://', transmitting data over unencrypted channels. This vulnerability exposes real-time communication to eavesdropping, man-in-the-middle attacks, and data manipulation.

// Vulnerable: Insecure WebSocket connection
const WebSocket = require('ws');

// Dangerous: Unencrypted WebSocket connection
const ws = new WebSocket('ws://example.com:8080/chat');

ws.on('open', function open() {
  console.log('Connected to WebSocket server');
  ws.send('Hello Server!');
});

ws.on('message', function message(data) {
  console.log('Received:', data);
});

ws.on('error', function error(err) {
  console.error('WebSocket error:', err);
});

// Secure: TLS-encrypted WebSocket connection
const WebSocket = require('ws');
const https = require('https');

// Use environment variable for protocol selection
const protocol = process.env.NODE_ENV === 'production' ? 'wss' : 'ws';
const host = process.env.WEBSOCKET_HOST || 'example.com';
const port = process.env.WEBSOCKET_PORT || 8443;

// Secure: Encrypted WebSocket connection
const ws = new WebSocket(`${protocol}://${host}:${port}/chat`, {
  // Additional security options
  rejectUnauthorized: true,
  checkServerIdentity: (servername, cert) => {
    // Custom certificate validation if needed
    return undefined; // No error means valid
  }
});

ws.on('open', function open() {
  console.log('Securely connected to WebSocket server');
  ws.send('Hello Server!');
});

ws.on('message', function message(data) {
  console.log('Received:', data);
});

ws.on('error', function error(err) {
  console.error('WebSocket error:', err);
});

Why it happens

JavaScript applications create WebSocket connections using insecure ws:// protocol: new WebSocket('ws://example.com/socket') instead of secure wss:// variant. Unencrypted WebSocket connections transmit all real-time data including chat messages, notifications, live updates, authentication tokens, and user actions in plaintext. Network attackers with packet capture capabilities intercept WebSocket traffic on public WiFi, ISP infrastructure, or compromised networks. Man-in-the-middle attackers can read sensitive data, inject malicious messages into WebSocket streams, or hijack connections by stealing authentication frames. WebSocket upgrade from HTTP inherits HTTP's lack of encryption when using ws://, making it as insecure as plain HTTP despite being separate protocol.

Fixes

Related Vulnerabilities