CVE-2020-10689: A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access...

Summary

A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name ...

What to do

Update eclipse che to version 7.9.0 or later.

Affected software

Vendor	Product	Affected versions
eclipse	che	< 7.9.0 `cpe:2.3:a:eclipse:che::::::::`

Original advisory text

A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access...

A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name and namespace of the target pod.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689 Issue Tracking Patch Third Party Advisory
https://github.com/eclipse/che/issues/15651 Exploit Issue Tracking Third Party Advisory