CVE-2020-14368 : Security Advisory and Response

A flaw in Eclipse Che prior to version 7.14.0 allows a Cross-Site Request Forgery (CSRF) attack, potentially leading to a WebSocket hijack on Theia IDE.

Understanding CVE-2020-14368

This CVE involves a vulnerability in Eclipse Che that impacts CodeReady Workspaces, potentially compromising confidentiality, integrity, and system availability.

What is CVE-2020-14368?

The flaw in Eclipse Che versions prior to 7.14.0 affects CodeReady Workspaces.
The vulnerability arises when Theia IDE is configured with cookies authentication, failing to set the SameSite value correctly.
This misconfiguration enables a CSRF attack, allowing a cross-site WebSocket hijack on Theia IDE.
An attacker can exploit this flaw to gain unauthorized access to a victim's workspace through the /services endpoint.
The attack involves a Man-in-the-middle (MITM) scenario where the victim is tricked into executing a request via an untrusted link.

The Impact of CVE-2020-14368

The vulnerability poses a significant threat to confidentiality, integrity, and system availability.

Technical Details of CVE-2020-14368

This section provides detailed technical insights into the CVE.

Vulnerability Description

CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in Eclipse Che.

Affected Systems and Versions

Product: Eclipse
Version: che-theia 7.14.0

Exploitation Mechanism

Attackers exploit the misconfigured SameSite value in Theia IDE to conduct CSRF attacks and WebSocket hijacking.

Mitigation and Prevention

Protect your systems from CVE-2020-14368 with these mitigation strategies.

Immediate Steps to Take

Update Eclipse Che to version 7.14.0 or later to address the vulnerability.
Implement proper authentication mechanisms to prevent CSRF attacks.

Long-Term Security Practices

Regularly monitor and audit authentication configurations to ensure proper security measures.
Educate users about the risks of executing requests from untrusted sources.

Patching and Updates

Stay informed about security updates and patches for Eclipse Che to address vulnerabilities promptly.