code-server session cookie can be extracted by having user visit specially crafted proxy URL
code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy subpath can result in the attacker gaining access to the session token. Failure to properly validate the port for a proxy request can result in proxying to an arbitrary domain. The malicious URL `https://<code-server>/proxy/[email protected]/path` would be proxied to `[email protected]/path` where the attacker could exfiltrate a user's session token. Any user who runs code-server with the built-in proxy enabled and clicks on maliciously crafted links that go to their code-server instances with reference to /proxy
- Auf 4.99.4 aktualisieren
Veröffentlicht Aktualisiert