Executive brief
Eclipse Che's dashboard backend includes a data resolver API endpoint used to fetch remote configuration files. An authenticated user can exploit a server-side request forgery (SSRF) vulnerability in this endpoint to access internal network services—such as cloud provider credential endpoints, Kubernetes services, and loopback addresses—that should not be directly reachable, potentially exposing sensitive credentials and enabling lateral movement within the infrastructure.
Technical details
The vulnerability exists in the POST /dashboard/api/data/resolver endpoint, which accepts a caller-supplied URL and passes it directly to an axios HTTP GET request without filtering the destination address. The only input validation is a JSON schema pattern requiring URLs to start with "http", which permits loopback (127.x, ::1), link-local (169.254.x for cloud IMDS), RFC-1918 private ranges (10.x, 172.16–31.x, 192.168.x), and in-cluster Kubernetes service addresses. The endpoint is protected by upstream OAuth authentication, so only authenticated dashboard users can exploit it, but in a multi-tenant deployment this is a low-privilege baseline attacker. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) exists in the configuration but is not enforced by this route. The fix in version 7.122.0 adds destination IP filtering, operator allowlist enforcement, and disables HTTP redirects.
Affected products
- Eclipse Che 7.79.0 through 7.121.0
Timeline
- 2026-09-08: disclosed
- 2026-08-31: patched: Fix merged in version 7.122.0