GHSA-6g6r-q6gw-w8fg

Описание

Summary

praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://[a-z0-9]{32} is applied with re.match(), which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characters after chrome-extension:// — including non-alphanumeric trailing characters — passes the check.

This is a patch bypass of GHSA-8x8f-54wf-vv92. That advisory triggered the addition of origin validation; this finding shows the validation is bypassable by any WebSocket client that forges an Origin header. After bypassing, the attacker can send start_session commands that are executed by any Chrome extension currently connected to the server — causing the extension to perform arbitrary browser automation including cookie theft and screenshot capture.

Details

Vulnerable code — browser/server.py line 186:

re.match() returns a match object if the pattern matches at the beginning of the string; trailing characters after the 32nd are not evaluated. re.fullmatch() (or anchoring with $) is required to enforce exact length.

There is no other authentication mechanism in _handle_connection(). Confirmed by source inspection:

• No bearer token check
• No API key check
• No extension ID allowlist
• Origin header regex is the only gate before websocket.accept()

After connection, start_session reaches _handle_start_session() (lines 283-414), which:

1. Creates a BrowserAgent with the attacker-specified goal and model
2. Broadcasts start_automation to every connected Chrome extension
3. The extension then performs the goal on the user's browser

PoC

Requirements: PraisonAI browser server running on default 127.0.0.1:8765

Start the server:

Step 1 — Verify regex bypass (no server needed):

Step 2 — Connect with forged Origin (requires websockets package):

Step 3 — Confirm auth logic (code analysis):

Output:

Impact

What kind of vulnerability: Authentication bypass — WebSocket access control bypass via regex mismatch.

Who is impacted:

Default configuration (127.0.0.1 binding): Any process running on the same machine (including malicious code in a compromised dependency, a rogue browser tab via localhost SSRF, or an attacker with local access) can connect to the browser automation server.

Remote configuration (PRAISONAI_BROWSER_ALLOW_REMOTE=true): Any remote attacker can connect without credentials. The browser server is fully exposed on 0.0.0.0:8765 with only the bypassable regex as the auth gate.

Impact after exploitation:

• Arbitrary browser automation on the victim's Chrome instance
• Exfiltration of session cookies from all open browser tabs
• Screenshots of all open browser sessions
• Automated actions on any authenticated site the victim's browser is logged into (email, banking, corporate SSO applications)

This is a patch bypass — the patch for CVE-2026-40289 / GHSA-8x8f-54wf-vv92 added the origin check but used re.match() instead of re.fullmatch(), leaving it exploitable. CVE-2026-40289 described "Origin header absent → accepted". This finding shows "Origin present but 33+ chars → accepted" — a distinct, unpatched bypass of the same security boundary.