GitHub Advisoryadvisory · npm

GHSA-v9w2-v7j9-rjpr Remote code execution in Eclipse Theia

HIGH Published 2021-09-02 Modified 2021-09-13 Official page ↗
Aliases
CVE-2021-34435
Ecosystem
npm
Packages
@theia/mini-browser
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-346, CWE-668, CWE-942
Reviewed
2021-09-02

Affected packages

• npm @theia/mini-browser: >= 0.3.9, < 1.9.0 → fixed in 1.9.0

Description

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.

Related

Alias · CVE (1)

  • CVE-2021-34435 In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. vulnerability

Weakness · CWE (3)

  • CWE-346 Origin Validation Error weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains weakness

References