GitHub Advisoryadvisory · npm

GHSA-f7vx-j8mp-3h2x Insufficient Verification of Data Authenticity in Eclipse Theia

HIGH Published 2021-04-13 Modified 2021-03-29 Official page ↗
Aliases
CVE-2019-17636
Ecosystem
npm
Packages
@theia/mini-browser
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-345
Reviewed
2021-03-29

Affected packages

• npm @theia/mini-browser: >= 0.3.9, < 0.16.0 → fixed in 0.16.0

Description

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the hosts filesystem, given their path, without restrictions on the requesters origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

Related

Alias · CVE (1)

  • CVE-2019-17636 In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as… vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References