PT-2023-20500 · Unknown · Code-Server

Published 2023-03-23 · Updated 2025-02-25 · CVE-2023-26114

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions code-server versions prior to 4.10.1

Description The issue is related to Missing Origin Validation in WebSockets handshakes. This can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Recommendations For versions prior to 4.10.1, update to version 4.10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebSockets handshake functionality until a patch is applied.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

CWE-1385

Related Identifiers

CVE-2023-26114

GHSA-FRJG-G767-7363

Affected Products

Code-Server

References · 10

• https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26114 · Security Note
• https://security.snyk.io/vuln/SNYK-JS-CODESERVER-3368148 · Patch
• https://osv.dev/vulnerability/CVE-2023-26114 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-frjg-g767-7363 · Vendor Advisory
• https://github.com/coder/code-server · Note
• https://github.com/coder/code-server/releases/tag/v4.10.1 · Note
• https://t.me/cvenotify/112466 · Telegram Post
• https://t.me/cibsecurity/60545 · Telegram Post
• https://t.me/cvenotify/46697 · Telegram Post