# Lack or Origin check leads to Cross-Site Websocket Hijacking (CSWSH)

Coda's WebSocket collab endpoint skipped Origin validation, letting a malicious page hijack a victim's session to read or modify documents.

- Payout: $800
- Severity: high
- Program: Superhuman (formerly Grammarly)
- Found by: fisher
- Disclosed: 2020-01-04
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/535436
- Library page: https://bugbountylibrary.com/r/h1%3A535436
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:websocket technique:recon vuln:access-control vuln:csrf

**Target:** WebSocket collaboration endpoint /documentsCollab/<docId>/collab/
**Root cause:** The server does not validate the Origin header during the WebSocket handshake, and no CSRF token is sent in WS messages, so cross-origin pages can open authenticated sockets.
**Steps:**
1. Log in to coda.io, open a document, proxy traffic through Burp.
2. In Burp Proxy > WebSocket history, select the URL `https://coda.io/documentsCollab/<docId>/collab/?params=PARAMS&connectionId=CONNECTIONID&EIO=3&transport=websocket`.
3. Decode `params` base64 to get `{"documentId":"DOCID"}`.
4. Open the URL as `wss://` from a different origin (e.g. Simple WebSocket Client extension); the server accepts and sends a message, confirming no Origin check.
5. Attacker (invited as view-only collaborator) learns the docId, embeds a CSWSH payload on a malicious page, and sends the link to the victim.
6. Victim opens the page; the socket connects with victim cookies, letting the attacker issue operations (delete/alter content) or read data.
**How found:** Researcher knew WebSockets bypass SOP and tested the handshake by replaying the collab wss URL from a separate client, observing the server accepted it and replied without Origin validation.
**Exploitation:** Attacker must be a collaborator to learn the document ID. They host a page that opens a wss connection to the collab endpoint; the victim's browser attaches session cookies, and the unchecked Origin lets the attacker drive full-duplex WS operations as the victim.
**Insight:** WebSocket handshake endpoints often skip Origin checks even when the REST API enforces CSRF; replay the wss URL from a foreign origin and watch for an immediate server message to confirm CSWSH.

## Proof of concept (copied exactly from the original report)

**WebSocket URL used to test Origin check**

```
https://coda.io/documentsCollab/<docId>/collab/?params=PARAMS&connectionId=CONNECTIONID&EIO=3&transport=websocket
```

**Base64 params holding document ID**

```
{"documentId":"DOCID"}
```