CVE-2019-17633 : Security Advisory and Response
Learn about CVE-2019-17633 affecting Eclipse Che versions 6.16 to 7.3.0. Understand the CSRF vulnerability allowing malicious websites to launch Che workspaces without authentication and TLS.
Eclipse Che versions 6.16 to 7.3.0 are affected by a vulnerability that allows a malicious website to trigger the launch of any Che workspace when both authentication and TLS are disabled.
Understanding CVE-2019-17633
This CVE involves a Cross-Site Request Forgery (CSRF) vulnerability in Eclipse Che.
What is CVE-2019-17633?
Between versions 6.16 and 7.3.0 of Eclipse Che, if authentication and TLS are turned off, a malicious site can start any Che workspace. This issue is more critical for local installations like personal laptops.
The Impact of CVE-2019-17633
The vulnerability enables a malicious website to initiate the launch of any Che workspace when authentication and TLS are disabled, potentially leading to unauthorized workspace access.
Technical Details of CVE-2019-17633
This section provides more technical insights into the vulnerability.
Vulnerability Description
The vulnerability in Eclipse Che versions 6.16 to 7.3.0 allows a malicious website to trigger the launch of any Che workspace when both authentication and TLS are disabled.
Affected Systems and Versions
- Product: Eclipse Che
- Vendor: The Eclipse Foundation
- Versions: 6.16.0 to 7.3.0 inclusive
Exploitation Mechanism
When authentication and TLS are disabled, a malicious website can exploit this vulnerability to launch any Che workspace, even if the Che API is not externally accessible.
Mitigation and Prevention
Protecting systems from CVE-2019-17633 is crucial to prevent unauthorized workspace launches.
Immediate Steps to Take
- Enable authentication and TLS on all Eclipse Che installations to prevent unauthorized workspace launches.
- Avoid visiting untrusted websites while using Eclipse Che without proper security configurations.
Long-Term Security Practices
- Regularly update Eclipse Che to the latest secure versions to patch known vulnerabilities.
- Educate users on the risks of running Eclipse Che with disabled authentication and TLS.
Patching and Updates
- Apply patches provided by Eclipse Che promptly to address the CSRF vulnerability and enhance overall security.