Description

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-03T15:17:39.763Z",
  "pubdate": "2026-09-03T15:17:39.763Z",
  "executiveSummary": "Taipy suffers from a critical security misconfiguration within its socket.io server implementation, specifically regarding Cross-Origin Resource Sharing (CORS) policy management. By default, the application permits wildcard CORS origins ('*') while simultaneously enabling the credentials flag, which allows for the initiation of authenticated WebSocket connections from unauthorized, arbitrary domains.\nThis vulnerability effectively bypasses standard browser-based Same-Origin Policy (SOP) protections for WebSocket communication. An attacker can craft a malicious web page that, when visited by a victim with an active Taipy session, initiates a background WebSocket handshake. Because credentials are permitted, the browser automatically includes relevant cookies or authentication headers in the request, granting the attacker a valid session context.\nThe primary risk lies in the lack of Cross-Site Request Forgery (CSRF) protections for internal Taipy state modifications and action callbacks. An attacker can remotely invoke sensitive application functions, modify state variables, or trigger unauthorized backend actions without the victim's interaction. This enables full unauthorized control over the Taipy application instance accessible to the victim, posing a significant threat to data integrity and system availability. No authentication or specific user privileges are required for the attacker beyond hosting a malicious domain and social engineering a victim to navigate to it.",
  "technicalDetails": "The root cause of this vulnerability is the insecure configuration of the underlying socket.io server instance within the Taipy framework. The server is configured with the 'Access-Control-Allow-Origin' header set to a wildcard ('*') while the 'Access-Control-Allow-Credentials' flag is set to 'true'. Under the WebSocket protocol and standard CORS specifications, browsers explicitly forbid the use of wildcard origins when credentials (cookies, authorization headers, or TLS client certificates) are required for the connection.\nWhen Taipy permits this configuration, it enables a Cross-Site WebSocket Hijacking (CSWSH) attack vector. The attack flow begins with an attacker hosting a malicious webpage containing a script that attempts to establish a WebSocket connection to the victim's Taipy application URL. When the victim accesses this malicious page, their browser attempts the WebSocket upgrade handshake. Due to the misconfiguration, the Taipy server accepts the request from the arbitrary origin and includes the necessary CORS headers to allow the handshake to succeed. Because credentials are enabled, the victim's authentication context is transparently attached to the WebSocket connection.\nOnce the persistent, credentialed WebSocket session is established, the attacker can transmit serialized Taipy protocol messages through the socket. Since the Taipy implementation lacks CSRF mitigation mechanisms for these frames, the server processes these incoming requests as legitimate commands originating from the authenticated user. This allows the attacker to reach restricted internal functions, specifically those intended for state variable manipulation and application-level action callbacks.\nThis vulnerability effectively renders the WebSocket channel a conduit for unauthorized command execution. An attacker can perform state injection, potentially altering the application's logic, exposing sensitive data stored in the state, or triggering backend processes designed for the authenticated user. Because the communication is real-time and bidirectional, the attacker can also receive responses from the server, facilitating data exfiltration and enabling complex multi-step exploits. This network exposure is only limited by the victim's ability to reach the Taipy server, making it a critical threat for internal applications that rely on implicit trust through authentication cookies or headers without additional transport-layer security or origin-validation tokens."
}