CVE-2025-68930

🔍 Analysis of CVE-2025-68930: WebSocket Hijacking Vulnerability in Traccar

The CVE-2025-68930 exposes a critical Cross-Site WebSocket Hijacking (CSWSH) vulnerability in Traccar, the open-source GPS tracking system. Below are the key details:

---

🛡️ Vulnerability Details

• Affected endpoint: /api/socket.
• Root cause: Lack of validation of the Origin header during the WebSocket handshake.
• Exploitation mechanism:
  1. An attacker tricks an authenticated user into visiting a malicious site.
  2. The malicious site establishes a WebSocket connection with the Traccar server using the active user session (JSESSIONID).
  3. The server accepts the connection and transmits real-time data to the attacker.

---

📊 Impact and Risks This vulnerability allows unauthorized access to sensitive data:

• Real-time tracking: Exact coordinates (latitude/longitude) of all assets.
• Exposed metadata: Device IDs, protocols, and battery levels.
• Severity: High (7.1 according to GitHub / 6.5 according to NIST).

---

🛠️ Affected Versions and Solutions

• Vulnerable versions: All up to 6.11.1 (inclusive).
• Immediate mitigation:
  • Implement strict Origin validation using an allowlist in the server configuration.