microsoft/UFO: Missing Authorization Check in DEVICE_INFO_REQUEST Causes Cross-Device Information Disclosure

Vulnerability Overview Missing authorization check in allows clients to read of other devices. Description clients connected to the UFO WebSocket server can invoke and retrieve the server-side for any target name they specify. This operation is intended to provide information to clients—the code comments and documentation indeed state this—but the caller's role is never actually checked. The only verification performed is on . Without spoofing, race conditions, or guesswork, the response is returned directly to the caller's channel. What is Broken It is worth specifying precisely which controls are present and which are absent, as the surrounding mechanisms appear to be designed to prevent this scenario. Authentication is present. checks that and match the connection registration, rejecting any mismatched messages. An attacker fails via this trivial check because they are indeed a , and their message states . There is no spoofing. Routing is correct. sends the response via , bound to the channel of the requesting connection, exactly as its documentation promises. Therefore, this is not a case of a response leaking to the wrong channel—the data indeed goes where it was requested. Authorization is the missing piece. It is never checked. Once the dispatcher knows the (correct) caller's role, it never asks whether that role is permitted to perform this action or read this target. simply returns any information it holds for that ID. Thus, the device bypassed two checkpoints that were never implemented: it executed an operation reserved for constellations (no functional level check) and picked any device ID it desired (no object level check). Authentication answered "who are you," but no one wrote "you are allowed to do this." Impact Cross-device data leak, read-only. A compromised or malicious device can pull the stored of another device: hostname, internal IP, platform and OS version, CPU and memory, plus any metadata tags and deployment tier tags attached by the operator, such as or , etc. This is precisely the inventory you want before deciding which host is suitable for the next step. There is no write capability, no command execution, availability is unaffected, and no secrets are leaked unless the operator stores them in device metadata. When multiple devices share a server—UFO is built for (pre) device configuration and constellations ( routing)—on strict single-device servers with no readable peers, the missing check remains irrelevant but still exists. A prerequisite I will not gloss over: the attacker needs to know the victim's . There is no exposed client list on the network, so this is not a self-contained fleet scan. In practice, device IDs are assigned by operators and tend to appear in logs and earlier reconstructions, which is why I still gave AC a low score—but I do not claim enumeration. Affected microsoft/UFO, main at adcf1308789d815356977ed742956dc2aa44509 ufo/server/ws/handler.py - handle_message, handle_device_info_request, get_device_info ufo/server/services/client_connection_manager.py - get_device_system_info Reproduction No phone, emulator, ADB, or external services required. The PoC drives the real , , and in-process, stubbing only the network transport so it can read returned frames. The device context PoC constructs real connection state, not shortcuts. Without identity binding, decisively rejects . The registered connection—identity bound, role —is exactly what is tested. PoC Code Expected Behavior A device inquiring about another device's information should receive an error with no data. Only registered should be able to access , and only for devices they manage. Fix Before doing any work, read the role to which the connection is bound. This closes the functional-level vulnerability. It is worth doing two things at the top: narrow the scope of constellations to devices they actually manage, rather than using , and run the same registered role check in to cover other privileged message types, not just . Test Suggestions

Goal Reached Thanks to every supporter — we hit 100%!

microsoft/UFO: Missing Authorization Check in DEVICE_INFO_REQUEST Causes Cross-Device Information Disclosure

More from this source