CVE-2023-26114: code-server Missing Origin Validation in WebSockets
Summary
CVE-2023-26114: code-server vulnerable to Missing Origin Validation in WebSockets. Affects code-server versions < 4.10.1. Fixed in 4.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
code-server is an open-source platform that allows users to run a code editor in a web browser. It provides a web-based interface for coding and editing files remotely. The vulnerability in code-server versions prior to 4.10.1 allows for Missing Origin Validation in WebSockets handshakes. This means that in certain scenarios, an attacker can access data from and connect to the code-server instance.
Vulnerability Detail
The Missing Origin Validation in WebSockets vulnerability in code-server can be exploited by an adversary to bypass origin validation during the WebSocket handshake. This allows the attacker to establish a connection to the code-server instance and potentially access sensitive data. The vulnerability has a CVSS score of 9.3, indicating a critical severity level. It is important to note that this vulnerability only affects code-server versions before 4.10.1.
How To Fix
Minimum fixed version
4.10.1
This is the first release that contains the fix.
npm install code-server@4.10.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update code-server to the fixed version to mitigate the risk of exploitation.
Conclusion
The Missing Origin Validation in WebSockets vulnerability in code-server can be critical, allowing unauthorized access to the code-server instance. It is crucial to update code-server to version 4.10.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for code-server →
FAQ
code-server is an open-source platform that allows users to run a code editor in a web browser. It provides a web-based interface for coding and editing files remotely.
The vulnerability allows an attacker to bypass origin validation and establish a connection to the code-server instance. This can potentially lead to unauthorized access to sensitive data.
Versions of code-server before 4.10.1 are affected by this vulnerability.
Yes, updating code-server to version 4.10.1 or later fixes this vulnerability.
No, there are no known workarounds. It is essential to update code-server to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for code-server.
