CVE-2023-0957

Name of the Vulnerable Software and Affected Versions Gitpod versions prior to release-2022.11.2.16

Description The issue allows attackers to make WebSocket connections to the Gitpod JSONRPC server using a victim’s credentials due to the lack of restriction on the Origin header. This can lead to the extraction of data from workspaces or a full takeover of the workspace.

Recommendations For versions prior to release-2022.11.2.16, update to release-2022.11.2.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Gitpod JSONRPC server to minimize the risk of exploitation.