# Impersonation Vulnerability in Websocket Chat

**URL:** <https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499>\
**Category:** Android\
**Tags:** group-channel, chatsdk\
**Created:** [October 26, 2023, 8:02am UTC](https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499 "2023-10-26T08:02:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![matias2023](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/matias2023/32/4642_2.png) [@matias2023](https://community.sendbird.com/u/matias2023)\
**Post date:** [October 26, 2023, 8:02am UTC](https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499/1 "2023-10-26T08:02:43Z")

</div>

**[Problem/Question]**

I’ve identified a potential security vulnerability regarding websocket impersonation in our chat system. By capturing and modifying the `channel_id` value from a websocket message, it’s possible to impersonate another user. How can avoid it?

* * *

// If problem, please fill out the below. If question, please delete.

4.12.3

// What version of the SDK are you using?

**[Reproduction Steps]**

1- Launch an interceptor tool like Burp.

2- Assume three users (user1, user2, user3) , let’s start a chat from user1 to user2 with text = “Hello from user1 to user2”

3- Capture the websocket message in Burp. An example message

```auto

MESG{"channel_id":123123123,"scrap_id":"","user":{"name":"Test","image":"","require_auth_for_profile_image":false,"guest_id":"456","id":456456,"role":"","metadata":{},"is_bot":false,"is_ai_bot":false,"is_active":true},"silent":false,"check_reactions":false,"is_op_msg":false,"is_guest_msg":true,"data":"{\"isDeepLink\":false,\"sender\":{\"id\":\"456\",\"name\":\"usernametest\"}}","sts":169807123123,"channel_url":"sendbird_group_channel_123123_123123123","channel_type":"group","is_super":false,"mention_type":"users","mentioned_users":[],"message_events":{"send_push_notification":"receivers","update_unread_count":true,"update_mention_count":true,"update_last_message":true},"message_retention_hour":-1,"request_id":"123123123","translations":{},"custom_type":"","is_removed":false,"last_updated_at":1698072673333,"message":"Hello from user1 to user2","msg_id":789789,"ts":1698072644444,"req_id":"456456456"}

```

4- Send that websocket message to repeater

5- Confirm that user2 has received user1 message.

6- Start a chat from user2 to user3 sending e.g. “Hello from user2 to user3”

7- Capture that websocket message using Burp and note the channel\_id from user2 to user3.

8- In Burp’s repeater tool, replace the original `channel_id` (from step 4) with the new `channel_id` from step 8. Modify the message content if desired, then resend.

9- `user2` will receive a message seemingly from `user3` , even though `user3` did not send it.

**[Frequency]**

Always

**[Current impact]**

It’s critical.

---

<div class="post-metadata">

**Author:** ![Tyler](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/tyler/32/810_2.png) [@Tyler](https://community.sendbird.com/u/Tyler)\
**Post date:** [October 26, 2023, 8:04am UTC](https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499/2 "2023-10-26T08:04:21Z")

</div>

Hello,

Thank you for reporting this issue. It’s quite an interesting concept because its not one that is long lived, given a refresh would fix the issue. I’ll have to bring this up to our Engineering team as I don’t think this is a critical issue given the necessary steps to intercept the WSS connection.

---

<div class="post-metadata">

**Author:** ![matias2023](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/matias2023/32/4642_2.png) [@matias2023](https://community.sendbird.com/u/matias2023)\
**Post date:** [October 26, 2023, 2:16pm UTC](https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499/4 "2023-10-26T14:16:11Z")

</div>

Thanks for your answer, is there a way to encrypt those parameters like channel\_id to avoid interceptors? Or a better way to establish a 1vs1 chat ?

---

<div class="post-metadata">

**Author:** ![matias2023](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/matias2023/32/4642_2.png) [@matias2023](https://community.sendbird.com/u/matias2023)\
**Post date:** [October 26, 2023, 6:18pm UTC](https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499/5 "2023-10-26T18:18:34Z")

</div>

I was thinking about the vulnerability and it could be critical because channel\_id is autoincremental, so you can increase one by one the channel\_id (and also the req\_id) and start a big spam.  
And i dont understand when you say “given a refresh would fix the issue” because if i refresh the chat or close and open the app, the messages still there.

---

<div class="post-metadata">

**Author:** ![matias2023](https://sea2.discourse-cdn.com/flex020/user_avatar/community.sendbird.com/matias2023/32/4642_2.png) [@matias2023](https://community.sendbird.com/u/matias2023)\
**Post date:** [November 2, 2023, 12:55pm UTC](https://community.sendbird.com/t/impersonation-vulnerability-in-websocket-chat/8499/6 "2023-11-02T12:55:20Z")

</div>

Hi, is there a better way to create one-one chats to avoid this vulnerability? thanks!