CVE-2021-28161: Improper Neutralization of Input in Theia console
Summary
CVE-2021-28161: Improper Neutralization of Input in Theia console. Affects @theia/console versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is @theia/console, an npm package used in Eclipse Theia versions up to and including 1.8.0. It provides a debug console that allows users to interact with the application during debugging sessions. The debug console does not perform HTML escaping, making it vulnerable to arbitrary JavaScript code injection.
Vulnerability Detail
The vulnerability (CVE-2021-28161) arises from the lack of HTML escaping in the debug console of Eclipse Theia. This allows an attacker to inject arbitrary JavaScript code, potentially leading to various security issues. The injection of malicious code can compromise the confidentiality, integrity, and availability of the application. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.8.1
This is the first release that contains the fix.
npm install @theia/console@1.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually perform HTML escaping on any user input before displaying it in the debug console. This can be achieved by using appropriate HTML escaping functions or libraries. Here is an example of how to perform HTML escaping in JavaScript:
function escapeHtml(unsafe) {
return unsafe
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
}
const userInput = '<script>alert("XSS")</script>';
const escapedInput = escapeHtml(userInput);
console.log(escapedInput);
By applying HTML escaping to user input, the risk of JavaScript code injection can be mitigated.
Conclusion
In conclusion, the @theia/console package in Eclipse Theia versions up to and including 1.8.0 is vulnerable to arbitrary JavaScript code injection in the debug console. This can lead to various security issues and compromise the application's confidentiality, integrity, and availability. It is recommended to upgrade to version 1.8.1 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for @theia/console →
FAQ
The vulnerability allows an attacker to inject arbitrary JavaScript code, which can lead to various security issues such as cross-site scripting (XSS) attacks, data theft, and unauthorized access to sensitive information.
Eclipse Theia versions up to and including 1.8.0 are affected by this vulnerability. Users of applications built on these versions should upgrade to the fixed version of the @theia/console package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert analyzes the package-lock.json file to identify and alert in real-time for open-source vulnerabilities.
The vulnerability has a CVSS score of 6.1, indicating a moderate severity level. While it is not the highest severity, it still poses a significant risk and should be addressed promptly.
To fix this vulnerability, you should upgrade to version 1.8.1 or later of the @theia/console package. This version includes the necessary HTML escaping to prevent JavaScript code injection.
