CVE-2020-14368

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1823892 Issue Tracking Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1823892 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:che:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:03

Type Values Removed Values Added
References () https://bugzilla.redhat.com/show_bug.cgi?id=1823892 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=1823892 - Issue Tracking, Third Party Advisory

Information

Published : 2020-12-14 21:15

Updated : 2024-11-21 05:03


NVD link : CVE-2020-14368

Mitre link : CVE-2020-14368

CVE.ORG link : CVE-2020-14368


JSON object : View

Products Affected

eclipse

  • che
CWE
CWE-352

Cross-Site Request Forgery (CSRF)