Executive brief
code-server is a cloud-based development environment that allows developers to write and edit code through a web browser. A missing origin validation flaw in its WebSocket implementation could allow an attacker to hijack a user's code-server session from a malicious website, potentially exposing sensitive code, credentials, and project data. The vulnerability affects users with older browsers that lack modern cookie protections or those accessing code-server on shared domains.
Technical details
The vulnerability is a missing origin validation (CWE-1385, CWE-346) in code-server's WebSocket handshake implementation affecting versions before 4.10.1. An attacker can perform a cross-site WebSocket hijacking (CSWSH) attack by crafting a malicious webpage that establishes a WebSocket connection to a victim's code-server instance when the victim visits the attacker's site. The attack requires user interaction (visiting a malicious site) and is more exploitable in environments using older browsers without SameSite cookie support or shared domain deployments. The fix, deployed in version 4.10.1, adds origin header validation to reject WebSocket connections from unauthorized origins.
Affected products
- Coder code-server before 4.10.1
Timeline
- 2023-03-23: disclosed: GitHub Security Advisory GHSA-frjg-g767-7363 published
- 2023-03-03: patched: Fix merged in commit d477972c68fc8c8e8d610aa7287db87ba90e55c7
- 2023-03-23: advisory: CVE-2023-26114 assigned