XSS in Debug Console [Theia v1.8.0]

[luigigubello]

Bug Description:

In the debug console there is no HTML escaping, so arbitrary Javascript code can be injected. I think the issue is dangerouslySetInnerHTML in ansi-console-item.tsx (L41)

I think this issue is similar to #7283

Steps to Reproduce:

See also the attached PoC video.

Additional Information

• Theia Version: Theia 1.8.0

Questions

• Theia is an important open source project, but it hasn't set a Github security policy. Should it have one?

[waynebeaton]

I've assigned CVE-2021-28161 with this description:

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"

Let me know if updates are required.

[bobbyz007]

Any progress about this issue?

[marcdumais-work]

There is a tentative fix, under review: #9339

[marcdumais-work]

Any help validating the proposed fix is welcome.

[vince-fugnitto]

@waynebeaton @marcdumais-work is there anything we need to do regarding the cve?

[waynebeaton]

@waynebeaton @marcdumais-work is there anything we need to do regarding the cve?

The CVE has been assigned and promoted. Nothing more to do there (unless an update is required).