Cross Site Scripting（XSS）vulnerability in code-server

[Jyhtpy]

OS/Web Information

• Web Browser: firefox
• Local OS: Debian
• Remote OS:Debian
• Remote Architecture:
• code-server --version: v3.12.0

Steps to Reproduce

1.Open your browser and insert payload /static/test%3Cmy_tag_efb4535077ba29aaca28167c491b4249/%3E%3Cimg%20src=x%3E%3Cscript%3Ealert(1)%3C/script%3E

2.example: http://127.0.0.1:8080/static/test%3Cmy_tag_efb4535077ba29aaca28167c491b4249/%3E%3Cimg%20src=x%3E%3Cscript%3Ealert(1)%3C/script%3E

Screenshot

Notes

This issue can be reproduced in VS Code: Yes

[jsjoeio]

@code-asher is this expected since the person would have to have access to the vm/machine running code-server?

[mauri-sfdc]

@jsjoeio someone can send you a forged link that makes you execute arbitrary code in your code-server instance. See https://owasp.org/www-community/attacks/xss/

[code-asher]

Yeah we should probably make a habit of escaping everything we put into the HTML or switch to a templating language.

[mauri-sfdc]

@code-asher in my experience it's better to use a templating language that escapes everything by default, habits are hard to change ;)

[code-asher]

Very true! :D I believe we have switching to a templating system on our roadmap, maybe for now we can fix this issue until that switch happens.

[mauri-sfdc]

@code-asher I can take a crack at the fix

[jsjoeio]

@mauri-sfdc that would be awesome! Thank you for reporting this and providing extra links (for me!). Let us know how we can help.