Summary
OpenHuman's local dictation WebSocket accepts audio without client authentication or browser-origin validation. A client that can reach the endpoint, potentially including a malicious webpage, may trigger costly speech-to-text processing; in affected versions with unbounded audio buffering, sustained streaming may also consume excessive memory.
OpenHuman's local dictation WebSocket accepts audio without client authentication or browser-origin validation. A client that can reach the endpoint, potentially including a malicious webpage, may trigger costly speech-to-text processing; in affected versions with unbounded audio buffering, sustained streaming may also consume excessive memory.
Affected context
The issue affects OpenHuman's /ws/dictation WebSocket endpoint in versions before 0.57.44. Risk depends on whether a client can reach the local endpoint and submit audio; earlier affected versions may also retain streamed audio in an unbounded buffer. Missing client authentication and browser-origin validation can make the endpoint reachable by unintended clients, depending on the environment and browser policies.
The issue affects OpenHuman's /ws/dictation WebSocket endpoint in versions before 0.57.44. Risk depends on whether a client can reach the local endpoint and submit audio; earlier affected versions may also retain streamed audio in an unbounded buffer. Missing client authentication and browser-origin validation can make the endpoint reachable by unintended clients, depending on the environment and browser policies.
Exploit preconditions
- Attack surface: The local
/ws/dictationWebSocket endpoint - Required access: Network reachability to the endpoint; the endpoint does not require client authentication
- Trigger point: Submitting audio for speech-to-text processing, with sustained streaming relevant to memory exhaustion in affected versions with unbounded buffering
- Why exploitation is possible: The endpoint lacks client authentication and browser-origin validation, while audio processing and buffering can consume significant resources
- Attack surface: The local
/ws/dictationWebSocket endpoint - Required access: Network reachability to the endpoint; the endpoint does not require client authentication
- Trigger point: Submitting audio for speech-to-text processing, with sustained streaming relevant to memory exhaustion in affected versions with unbounded buffering
- Why exploitation is possible: The endpoint lacks client authentication and browser-origin validation, while audio processing and buffering can consume significant resources
Why this happens
The endpoint processes client-supplied audio without first establishing that the client is authorized or that a browser request comes from a trusted origin. This maps primarily to CWE-306: Missing Authentication for Critical Function. Resource-intensive processing and unbounded buffering also reflect CWE-400: Uncontrolled Resource Consumption and CWE-770: Allocation of Resources Without Limits or Throttling.
The endpoint processes client-supplied audio without first establishing that the client is authorized or that a browser request comes from a trusted origin. This maps primarily to CWE-306: Missing Authentication for Critical Function. Resource-intensive processing and unbounded buffering also reflect CWE-400: Uncontrolled Resource Consumption and CWE-770: Allocation of Resources Without Limits or Throttling.
Potential impact
- The application may become unresponsive or crash
- Speech-to-text processing may consume excessive CPU or other resources
- Unbounded buffering may exhaust process memory in affected versions
- Other local application functions may be disrupted by resource contention
- The application may become unresponsive or crash
- Speech-to-text processing may consume excessive CPU or other resources
- Unbounded buffering may exhaust process memory in affected versions
- Other local application functions may be disrupted by resource contention
General mitigation guidance
Defensive patterns include requiring authentication or an equivalent authorization check before accepting audio, and validating browser origins as an additional boundary rather than relying on origin checks alone. Apply limits to audio size, stream duration, buffer growth, and processing concurrency; use backpressure, timeouts, and resource quotas where appropriate. Treat client-supplied audio as untrusted and run the application with only the privileges and resources it needs.
Defensive patterns include requiring authentication or an equivalent authorization check before accepting audio, and validating browser origins as an additional boundary rather than relying on origin checks alone. Apply limits to audio size, stream duration, buffer growth, and processing concurrency; use backpressure, timeouts, and resource quotas where appropriate. Treat client-supplied audio as untrusted and run the application with only the privileges and resources it needs.
How teams detect issues like this
- Review WebSocket handlers for authentication and authorization checks before resource-intensive work begins.
- Use static analysis or code review to identify endpoints that accept client data without origin or access-control validation.
- Check audio-processing paths for bounded buffers, payload and duration limits, concurrency controls, and cleanup of resources.
- Monitor for unusual WebSocket connection rates, sustained audio streams, rising memory use, and repeated processing failures.
- Enforce application policies that require authentication and resource limits on local service endpoints; automated review tools may help flag missing controls.
- Review WebSocket handlers for authentication and authorization checks before resource-intensive work begins.
- Use static analysis or code review to identify endpoints that accept client data without origin or access-control validation.
- Check audio-processing paths for bounded buffers, payload and duration limits, concurrency controls, and cleanup of resources.
- Monitor for unusual WebSocket connection rates, sustained audio streams, rising memory use, and repeated processing failures.
- Enforce application policies that require authentication and resource limits on local service endpoints; automated review tools may help flag missing controls.
