Bug 1823892 (CVE-2020-14368)

Summary:	CVE-2020-14368 eclipse che: cross-site websocket hijack of service endpoint
Product:	[Other] Security Response	Reporter:	Siddharth Sharma <sisharma>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	crarobin, jmadigan, mbenatto, mbenitez, nboldt, ngough, scorneli, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
See Also:	https://issues.redhat.com/browse/CRW-1176 https://issues.redhat.com/browse/INTLY-9510 https://issues.redhat.com/browse/INTLY-9748
Whiteboard:
Fixed In Version:	che-theia 7.14.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Eclipse Che that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery (CSRF) and consequently allowing a cross-site WebSocket hijack on Theia IDE. This flaw allows an attacker to gain full access to the victim's workspace through the /services endpoint. To perform a successful attack, the attacker conducts a Man-in-the-middle attack (MITM) and tricks the victim into executing a request via an untrusted link, which performs the CSRF and the Socket hijack. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-19 14:33:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1860080
Bug Blocks:	1822258

Description Siddharth Sharma 2020-04-14 18:13:35 UTC

There's an issue with Eclipse Che, impacting on CodeReady Workspaces. When configured with Cookies authentication, Theia IDE doesn't properly set SameSite value allowing CSRF and consequently allowing cross-site websocket hijack on Theia IDE. An attacker may leverage this weakness to gain full-access to the victim's workspace through the /services endpoint. The an attack be successfully performed the attacker needs to perform a MITM and tricks the victim to execute a request via an untrusted link which performs the CSRF and the Socket hijack itself.

Comment 7 Dhananjay Arunesh 2020-09-02 04:45:24 UTC

Acknowledgments:

Name: Robin Duda

Comment 9 Marco Benatto 2020-10-05 14:50:35 UTC

There's an issue with Eclipse Che, impacting on CodeReady Workspaces. When configured with Cookies authentication, Theia IDE doesn't properly set SameSite value allowing CSRF and consequently allowing cross-site websocket hijack on Theia IDE. An attacker may leverage this weakness to gain full-access to the victim's workspace through the /services endpoint. The an attack be successfully performed the attacker needs to perform a MITM and tricks the victim to execute a request via an untrusted link which performs the CSRF and the Socket hijack itself.

Comment 11 Nick Boldt 2020-10-05 17:59:07 UTC

If fixed in https://github.com/eclipse/che-theia/commit/f9409ac45f977bfb745520f5826c18d41024ebcd (or any of the commits linked from here from May/June 2020) then the fixversion here should be set to:

Che 7.14 == CRW 2.2 [mappings can be seen here: https://issues.redhat.com/projects/CRW?selectedItem=com.atlassian.jira.jira-projects-plugin:release-page&status=released-unreleased ]

Since we're currently on CRW 2.5, with 2.4 released last week, it seems like this issue can be closed.

Comment 13 Nick Boldt 2020-12-07 17:03:57 UTC

This issue (for CodeReady Workspaces) was fixed in CRW 2.2 in Aug 2020. See https://issues.redhat.com/browse/CRW-1176.

I would be surprised if INTLY is still impacted too, as I'd expect they're using our latest 2.5.0 or 2.5.1 release.