CVE-2024-21583 github.com/gitpod-io/gitpod vulnerable to Cookie Tossing
Attackers controlling a subdomain can hijack sessions via cookie tossing, allowing them to perform actions on behalf of victims.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-21583?
CVE-2024-21583 is a medium-severity vulnerability in @gitpod/gitpod-protocol, published on 19 Jul 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.
Which versions are affected by CVE-2024-21583?
6 open source packages ship an affected version, including github.com/gitpod-io/gitpod, github.com/gitpod-io/gitpod/components/server/go and github.com/gitpod-io/gitpod/components/ws-proxy.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gitpod-io/gitpod Go | All versions | None |
github.com/gitpod-io/gitpod Go | All versions to 0.8.0 | None |
github.com/gitpod-io/gitpod Go | All versions to 0.8.0 | None |
github.com/gitpod-io/gitpod/components/server/go Go | All versions | None |
github.com/gitpod-io/gitpod/components/ws-proxy Go | All versions | None |
github.com/gitpod-io/gitpod/install/installer Go | All versions | None |
How do I fix CVE-2024-21583?
No fix has been published for CVE-2024-21583 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-21583 being exploited?
There is no known exploitation of CVE-2024-21583 in the wild and no public exploit code.
Sources
Also known as GHSA-8pgc-65mj-53h5, GO-2024-2997.