CVE-2023-26114 code-server vulnerable to Missing Origin Validation in WebSockets
An attacker can bypass origin validation in WebSockets to access data and connect to the code-server instance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-26114?
CVE-2023-26114 is a high-severity missing authorization vulnerability in code-server, published on 23 Mar 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
Which versions are affected by CVE-2023-26114?
2 open source packages ship an affected version, including code-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
code-server npm | All versions | 4.10.1 |
code-server npm | All versions | 4.10.1 |
Products include Coder Code-Server.
How do I fix CVE-2023-26114?
Upgrade code-server to 4.10.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-26114 being exploited?
There is no known exploitation of CVE-2023-26114 in the wild and no public exploit code.
Other vulnerabilities in code-server
Sources
Also known as GHSA-frjg-g767-7363.