Executive brief
Eclipse Theia's Mini-Browser extension exposes a file-reading HTTP endpoint that lacks proper origin verification. An attacker can exploit this via DNS rebinding or drive-by downloads to read arbitrary files from a user's system running Theia, potentially exposing sensitive configuration, source code, or credentials stored on the host.
Technical details
The vulnerability is an insufficient verification of data authenticity (CWE-345) in Eclipse Theia versions 0.3.9 through 0.15.0. The Mini-Browser extension (@theia/mini-browser) exposes an HTTP endpoint for file content retrieval without restricting the requester's origin, allowing cross-origin requests. An attacker can exploit this through DNS rebinding attacks (forcing the victim's browser to reconnect to attacker-controlled infrastructure under the target origin) or by tricking users into visiting malicious webpages that make requests to the unprotected endpoint. This allows arbitrary file read access from the host filesystem where Theia is running. The vulnerability was fixed in version 0.16.0 by restricting endpoint access to Electron's own browser-window via token-based verification.
Affected products
- Eclipse Theia 0.3.9 to 0.15.0
Timeline
- 2020-03-10: disclosed: CVE published
- 2020-02-25: patched: Fix merged in PR #7205
- 2021-04-13: advisory: GHSA advisory published