Vulnerability in MGdaasLab WHartTest

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/ui_automation/consumers.py
• github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/wharttest_django/asgi.py
• hackmd.io/@hieuPenguinnn/wharttest-ui-automation-websocket-missing-authentication
• www.vulncheck.com/advisories/wharttest-through-2.8.1-missing-authentication-on-ui-autom…