CVE-2024-21583 – This vulnerability allows cookie tossing attack... (How to Fix)

Q: What is the severity of CVE-2024-21583?

CVE-2024-21583 has a CVSS score of 4.1 (MEDIUM). This vulnerability allows cookie tossing attacks where an attacker controlling a subdomain can set the _gitpod_io_jwt2_ session cookie on the Gitpod control plane. This enables session hijacking where victim actions (like connecting GitHub organizations) are performed under the attacker's session. Affects Gitpod users running vulnerable versions of multiple Gitpod components.

📋 TL;DR

This vulnerability allows cookie tossing attacks where an attacker controlling a subdomain can set the _gitpod_io_jwt2_ session cookie on the Gitpod control plane. This enables session hijacking where victim actions (like connecting GitHub organizations) are performed under the attacker's session. Affects Gitpod users running vulnerable versions of multiple Gitpod components.

💻 Affected Systems

Products:

Gitpod Server
Gitpod WS-Proxy
Gitpod Auth Component
Gitpod Public API Server
Gitpod Installer Components
@gitpod/gitpod-protocol

Versions: All versions before main-gha.27122

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker control of subdomain; affects multiple Gitpod components with shared cookie handling.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attacker gains unauthorized access to victim's Gitpod workspace, can connect attacker-controlled GitHub organizations, potentially leading to code theft, repository compromise, or supply chain attacks.

🟠

Likely Case

Session hijacking allowing attacker to perform actions in victim's Gitpod session, potentially connecting malicious GitHub organizations or accessing workspace resources.

🟢

If Mitigated

Limited impact with proper subdomain controls and network segmentation; attacker would need control of legitimate subdomain.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires attacker to control a subdomain of the Gitpod deployment domain; no public exploit code available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: main-gha.27122 or later

Vendor Advisory: https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155

Restart Required: Yes

Instructions:

1. Update all affected Gitpod components to version main-gha.27122 or later. 2. Apply the fix commit da1053e1013f27a56e6d3533aa251dbd241d0155. 3. Restart Gitpod services. 4. Verify cookie now has __Host- prefix.

🔧 Temporary Workarounds

Subdomain Restriction

all

Restrict control of subdomains to prevent attackers from setting cookies

Cookie Validation

all

Implement server-side validation of cookie origins

🧯 If You Can't Patch

Monitor and restrict subdomain creation/control in your environment
Implement network segmentation to isolate Gitpod control plane from untrusted networks

🔍 How to Verify

Check if Vulnerable:

Check if _gitpod_io_jwt2_ cookie lacks __Host- prefix in browser developer tools or HTTP responses

Check Version:

Check Gitpod component versions against main-gha.27122

Verify Fix Applied:

Verify _gitpod_io_jwt2_ cookie now has __Host- prefix and Secure/HttpOnly flags

📡 Detection & Monitoring

Log Indicators:

Unusual cookie setting from subdomains
Multiple session cookies with same name

Network Indicators:

Cookie manipulation attempts from subdomains

SIEM Query:

Search for cookie: _gitpod_io_jwt2_ without __Host- prefix in web logs

📊 Metadata

CVE ID: CVE-2024-21583

CVSS v3 Score: 4.1 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

CWE: CWE-15

Published: July 19, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-21583, you might also want to check these: