CVE-2019-17636 Insufficient Verification of Data Authenticity in Eclipse Theia

High 8.1 Published 10 Mar 2020 Updated 5 Aug 2024

Remote attackers can read arbitrary host files via the Mini-Browser extension's unrestricted HTTP endpoint using DNS rebinding or drive-by downloads.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-17636?

CVE-2019-17636 is a high-severity path traversal vulnerability in Eclipse Theia, published on 10 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

Weakness: CWE-345

Which versions are affected by CVE-2019-17636?

2 open source packages ship an affected version, including @theia/mini-browser. It affects 1 product.

Package	Affected	Fixed in
`@theia/mini-browser` npm	From `0.3.9`	`0.16.0`
`@theia/mini-browser` npm	From `0.3.9`	`0.16.0`

Products include Eclipse Theia.

How do I fix CVE-2019-17636?

Upgrade @theia/mini-browser to 0.16.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-17636 being exploited?

There is no known exploitation of CVE-2019-17636 in the wild and no public exploit code.

Sources

Also known as GHSA-f7vx-j8mp-3h2x.