Executive brief
code-server is a platform that allows developers to run VS Code in a web browser. A security vulnerability was identified where the application failed to properly clean error messages before displaying them to users. An attacker could use this to execute malicious scripts in a user's browser, potentially leading to unauthorized actions or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Coder code-server versions prior to 3.12.0. The root cause is the failure to escape HTML content within error messages before rendering them on the error page (specifically within 'src/node/routes/errors.ts'). An attacker can exploit this by tricking a user into clicking a specially crafted URL containing malicious scripts. If successful, the attacker can execute arbitrary JavaScript in the context of the user's session, which could lead to session hijacking or unauthorized data access. The issue was resolved in version 3.12.0 by implementing proper HTML escaping for error message strings.
Affected products
- Coder code-server < 3.12.0
Timeline
- 2021-11-09: patched: Fix merged into main branch via PR 4430
- 2022-05-11: advisory: NVD published CVE-2021-42648
- 2022-05-12: disclosed: GitHub Advisory published