Cross-Site WebSocket Hijacking Vulnerability in Gitpod

CVE-2023-0957

What is CVE-2023-0957?

An issue in Gitpod exposes users to Cross-Site WebSocket Hijacking, where attackers can establish WebSocket connections to the Gitpod JSONRPC server using victims' credentials. This vulnerability occurs due to the unrestricted Origin header, allowing unauthorized actions that can extract sensitive data from workspaces and potentially lead to a complete takeover. Users are encouraged to update to version 2022.11.2.16 or later to mitigate this risk.

References