PT-2019-15240 · Eclipse · Eclipse Che

Michael Grube · Published 2019-12-19 · Updated 2019-12-27 · CVE-2019-17633

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Che versions 6.16 through 7.3.0

Description The issue allows an attacker to trigger the start of an arbitrary Che workspace by visiting a malicious website, given that both authentication and TLS are disabled. This scenario is more likely in local installations, such as on personal laptops, where Che is not typically exposed to public networks. However, JavaScript running in the local browser can still send requests to the Che API, posing a risk even when the API is not externally exposed.

Recommendations For Eclipse Che versions 6.16 through 7.3.0, consider enabling authentication and TLS to prevent unauthorized access and mitigate the risk of arbitrary workspace startup. As a temporary workaround, restrict access to the Che API to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-17633

Affected Products

Eclipse Che

References · 4

• 🔥 https://github.com/mgrube/CVE-2019-17633 · Exploit
• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=551596 · Exploit
• https://osv.dev/vulnerability/CVE-2019-17633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17633 · Security Note