Executive brief
Eclipse Theia is a cloud- and desktop-based IDE platform. Its plugin-ext component handles communication between webview contents and the main application. A vulnerability in message verification allows an attacker to hijack webview contents via postMessage(), potentially exposing or modifying sensitive information displayed within the IDE.
Technical details
The vulnerability is an improper verification of communication channel (CWE-940) in the @theia/plugin-ext component prior to version 1.18.0. The webview message handling does not properly validate the source frame of incoming postMessage() calls, allowing untrusted origins to send messages that are processed as legitimate. An attacker with ability to inject or control content in the webview (e.g., via a malicious plugin or compromised page) can send crafted messages to intercept or manipulate webview communications. The fix, merged in PR #10125, adds proper source frame verification to validate message origins before processing.
Affected products
- Eclipse Theia prior to 1.18.0
Timeline
- 2021-11-15: disclosed
- 2021-11-01: patched: Fix merged in PR #10125