Khaled Sarieddine

WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw can be exploited to gain unauthorized access to sensitive data, perform unauthorized actions, and lead to privilege escalation, potentially compromising the security of the entire system.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but permits multiple endpoints to connect using the same session identifier. This implementation leads to predictable session identifiers, which may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

Charging station authentication identifiers are publicly accessible through web-based mapping platforms.

Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or misuse of charging station services.

The WebSocket Application Programming Interface does not restrict the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry. It may also allow brute-force attacks to gain unauthorized access. The API lacks rate limiting on authentication requests, potentially impacting a large number of devices.

The WebSocket backend uses charging station identifiers to associate sessions, but allows multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for that station. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerability involves the use of the same session identifier for multiple endpoints, potentially allowing a malicious actor to intercept and manipulate communication with charging stations.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. This can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. The issue allows attackers to perform unauthorized station impersonation and manipulate data sent to the backend via the OCPP WebSocket endpoint.

The WebSocket Application Programming Interface does not restrict the number of authentication requests. This lack of rate limiting could enable attackers to perform denial-of-service attacks by disrupting or misdirecting legitimate charger telemetry. It may also allow brute-force attacks to gain unauthorized access.

Charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access to charging stations.

WebSocket endpoints are missing appropriate authentication, allowing attackers to impersonate charging stations and manipulate backend data. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier and then send or receive OCPP commands as a legitimate charger. This could lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data. The issue allows attackers to perform unauthorized station impersonation and manipulate data sent to the backend via the ''OCPP WebSocket endpoint''.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing where a recent connection can displace a legitimate charging station and receive intended backend commands. This may allow unauthorized user authentication or a denial-of-service condition by overwhelming the backend with valid session requests.

The WebSocket Application Programming Interface does not limit the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by suppressing or misrouting legitimate charger telemetry, or to conduct brute-force attacks to gain unauthorized access. The API endpoint is susceptible to abuse due to the absence of restrictions on authentication attempts. An attacker could exploit this by sending a high volume of requests to the `/websocket` endpoint, potentially overwhelming the system and disrupting legitimate services. The vulnerable parameter is the authentication request itself.

The backend utilizes charging station identifiers to uniquely associate sessions but permits multiple endpoints to connect using the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing where a newer connection replaces a legitimate charging station and receives intended backend commands. This may allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with session requests. The vulnerability impacts the association of sessions via charging station identifiers and the handling of multiple connections with the same session identifier.

WebSocket endpoints lack proper authentication mechanisms, allowing unauthenticated attackers to connect and impersonate legitimate charging stations. This enables attackers to issue or receive OCPP commands, potentially leading to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. An attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier. The vulnerability allows manipulation of data sent to the backend.

Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure allows unauthorized access to potentially sensitive information related to the charging infrastructure.

Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure potentially allows unauthorized access or manipulation of charging station services.

Authentication identifiers for charging stations are publicly accessible through web-based mapping platforms. This exposure allows unauthorized access to potentially sensitive information related to the charging infrastructure.

The WebSocket backend associates sessions using charging station identifiers, but allows multiple endpoints to connect with the same session identifier. This results in predictable session identifiers, enabling session hijacking or shadowing. A recent connection can displace a legitimate charging station and receive backend commands intended for it. This could allow unauthorized authentication or a denial-of-service condition by overwhelming the backend with valid session requests. The vulnerable component uses `session identifier` to associate WebSocket sessions. The API endpoint is susceptible to session hijacking.

The WebSocket Application Programming Interface does not limit the number of authentication requests. This lack of rate limiting could enable an attacker to perform denial-of-service attacks by suppressing or misrouting legitimate charger telemetry. It may also allow attackers to conduct brute-force attacks to gain unauthorized access. The API endpoints are susceptible to abuse due to the absence of request restrictions. The `authentication` process is vulnerable to brute-force attempts.