CVE-2020-14368 Cross-site request forgery in eclipse
Attackers can hijack user sessions and gain full workspace access via CSRF and WebSocket hijacking in Eclipse Che when using cookie authentication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-14368?
CVE-2020-14368 is a high-severity vulnerability in eclipse, published on 14 Dec 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Weakness: CWE-352
Which versions are affected by CVE-2020-14368?
It affects 1 product.
Products include Eclipse Che.
How do I fix CVE-2020-14368?
No fix has been published for CVE-2020-14368 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-14368 being exploited?
There is no known exploitation of CVE-2020-14368 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in eclipse
Sources
Also known as GHSA-mcp4-jxrc-pg4f.