Theia Terminal WebSocket Unauthorized Command Execution via Cross-Origin Access (GHSA-78g8-vm3p-97c6)

Vulnerability Overview Vulnerability Name: Cross-Origin WebSocket Access To Shell-Terminal Enables Command Execution And Output Exfiltration Vulnerability ID: GHSA-78g8-vm3p-97c6 Severity: High (8.8 / 10) Description: Theia's browser backend exposes privileged terminal RPC services ( , ) via WebSocket without service-level authentication or authorization. Source validation for WebSocket connections fails in ; connections are accepted by default if the header is missing or if the whitelist is not configured. Furthermore, the Socket.IO integration replaces the trusted header with the client-supplied header, allowing attackers to control or omit it. Scope of Impact Affected Packages: - (npm) - (npm) Affected Versions: - : >= 1.8.1 - : >= 1.8.1 Fixed Versions: - : 1.73.0 - : 1.73.0 Impact Description: Both local development setups (driven attacks when users visit malicious pages) and hosted/tunneled deployments (where backend WebSockets are accessible via external networks) are affected. Any user running a Theia browser application is impacted, regardless of whether is configured. Remediation 1. Configure : - Set the environment variable to a strict whitelist of expected values (e.g., ). Note: This does not fully mitigate the issue because the header can be overwritten, but it reduces the attack surface. 2. Network Isolation: - Do not expose Theia backends to untrusted networks. Use a reverse proxy with appropriate authentication in front of the WebSocket endpoints. 3. Disable Terminal Services: - If terminal functionality is not required, exclude from the Theia application build. Proof of Concept (POC) References Eclipse GitLab Vulnerability Report #376 Eclipse Foundation Security Handbook Theia THEIA-1057 documentation Credits ANWAR AYOUB ( @Lackmask ) on Eclipse GitLab, https://github.com/AnwarAyoub on GitHub (finder)

Goal Reached Thanks to every supporter — we hit 100%!

Theia Terminal WebSocket Unauthorized Command Execution via Cross-Origin Access (GHSA-78g8-vm3p-97c6)

More from this source