will-moss Isaiah Missing Authorization Vulnerability in WebSocket Master Handler

A vulnerability allowing for missing authorization in the WebSocket master handler has been identified in will-moss Isaiah versions through 1.36.9. The issue arises in the 'Server.Handle' function within 'app/server/server/server.go'. By manipulating the 'Agent' argument, it is possible to bypass authorization checks, potentially leading to unauthorized access and actions on Docker resources managed by an Agent node. This vulnerability can be exploited remotely, especially when Agent authentication is disabled or weak.

Impact

Exploitation of this vulnerability allows an unauthenticated client to send commands to registered Agent nodes via the Master node, bypassing the expected authentication checks. This can lead to unauthorized access and manipulation of Docker resources through the Agent, including reading container logs and metadata or performing management actions on Docker resources.

Reproduction

To reproduce this vulnerability, first ensure that Isaiah is running as a Master node with authentication enabled. Then, register at least one Agent node. Using a raw WebSocket client, send a command to the Master '/ws' endpoint with the 'Agent' field set to the name of the registered Agent. The Master will forward the command to the Agent without performing the necessary authentication check, allowing for unauthorized actions to be executed on the Agent node.

Remediation

A pull request has been made to require authentication before forwarding commands to Agent nodes. This change should be applied to ensure that all commands are properly authorized before being executed on an Agent.