Executive brief
Eclipse Theia is a cloud-based IDE framework that includes a mini-browser extension allowing developers to preview HTML files directly within the editor. A malicious HTML file can exploit the mini-browser's sandboxing to achieve remote code execution on the user's machine. Exploitation requires a user to open and preview a crafted HTML file, making this a user-interaction attack suitable for targeted social engineering.
Technical details
The mini-browser extension in Eclipse Theia renders HTML files inside an iframe within the IDE, but fails to properly isolate the previewed content from the host IDE process. The vulnerability (CWE-346: Origin Validation Error, CWE-668: Exposure of Resource to Wrong Sphere, CWE-942: Permissive Cross-domain Policy) allows a malicious HTML file to break out of the iframe sandbox and execute arbitrary code in the IDE's security context. This is a network-reachable, user-interaction attack: an attacker must craft a malicious HTML file and convince a user to preview it. The vulnerability affects versions 0.3.9 through 1.8.1 and was fixed in version 1.9.0 (commit 0761dcf5fe3c14c27432683d42d2c526ad0cfbd5).
Affected products
- Eclipse Theia 0.3.9 to 1.8.1
Timeline
- 2021-09-02: disclosed
- 2021-09-02: patched: Fix merged in PR #8759; version 1.9.0 released with the fix