PT-2024-18969 · Gitpod · Gitpod

Elliot Ward · Published 2024-07-19 · Updated 2024-10-31 · CVE-2024-21583

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions github.com/gitpod-io/gitpod/components/server/go/pkg/lib versions before main-gha.27122 github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy versions before main-gha.27122 github.com/gitpod-io/gitpod/install/installer/pkg/components/auth versions before main-gha.27122 github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server versions before main-gha.27122 github.com/gitpod-io/gitpod/install/installer/pkg/components/server versions before main-gha.27122 @gitpod/gitpod-protocol versions before 0.1.5-main-gha.27122

Description The issue is due to a missing Host- prefix on the gitpod io jwt2 session cookie, allowing an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane. This can be assigned to an attacker's own JWT, enabling them to perform specific actions taken by the victim, such as connecting a new Github organization.

Recommendations For github.com/gitpod-io/gitpod/components/server/go/pkg/lib versions before main-gha.27122, update to a version after main-gha.27122. For github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy versions before main-gha.27122, update to a version after main-gha.27122. For github.com/gitpod-io/gitpod/install/installer/pkg/components/auth versions before main-gha.27122, update to a version after main-gha.27122. For github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server versions before main-gha.27122, update to a version after main-gha.27122. For github.com/gitpod-io/gitpod/install/installer/pkg/components/server versions before main-gha.27122, update to a version after main-gha.27122. For @gitpod/gitpod-protocol versions before 0.1.5-main-gha.27122, update to version 0.1.5-main-gha.27122 or later.

Fix

Weakness Enumeration

CWE-15

CWE-565

Related Identifiers

CVE-2024-21583

GHSA-8PGC-65MJ-53H5

GO-2024-2997

Affected Products

Gitpod

References · 16

• https://osv.dev/vulnerability/GHSA-8pgc-65mj-53h5 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21583 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21583 · Vendor Advisory
• https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155 · Note
• https://github.com/gitpod-io/gitpod/pull/19973 · Note
• https://github.com/gitpod-io/gitpod · Note
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075 · Note
• https://t.me/cvedetector/1190 · Telegram Post
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074 · Note
• https://pkg.go.dev/vuln/GO-2024-2997 · Note
• https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d · Note
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077 · Note
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078 · Note
• https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079 · Note