CVE-2024-21583

Summary

CVE-2024-21583: Versions prior to main-gha.27122 of certain Gitpod packages, including github.com/gitpod-io/gitpod/components/server/go/pkg/lib, github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy, github.com/gitpod-io/gitpod/install/installer/pkg/components/auth, github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server, and github.com/gitpod-io/gitpod/install/installer/pkg/components/server, as well as @gitpod/gitpod-protocol before 0.1.5-main-gha.27122, are susceptible to a vulnerability called Cookie Tossing. This arises due to the absence of a required __Host- prefix on the _gitpod_io_jwt2_ session cookie. Consequently, an attacker controlling a subdomain can set this cookie on the Gitpod control plane, enabling them to impersonate the victim's session and carry out specific actions, such as connecting a new Github organization, under the attacker's control.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.