Eclipse Che
Monthly
Server-side request forgery in Eclipse Che dashboard backend (versions 7.79.0-7.121.0) enables any authenticated user to make the backend issue arbitrary outbound HTTP GET requests to internal network targets, including the cloud instance metadata service at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes service endpoints. The POST /dashboard/api/data/resolver endpoint forwards caller-supplied URLs with no host validation and without consulting the operator-configured allowlist (spec.devEnvironments.allowedSources.urls). The vulnerability is fixed in 7.122.0, which introduces private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables outbound redirect following. No public exploit or CISA KEV listing identified at time of analysis.
Server-side request forgery in Eclipse Che dashboard backend (versions 7.79.0-7.121.0) enables any authenticated user to make the backend issue arbitrary outbound HTTP GET requests to internal network targets, including the cloud instance metadata service at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes service endpoints. The POST /dashboard/api/data/resolver endpoint forwards caller-supplied URLs with no host validation and without consulting the operator-configured allowlist (spec.devEnvironments.allowedSources.urls). The vulnerability is fixed in 7.122.0, which introduces private-address blocking, IPv4-mapped IPv6 bypass prevention, allowlist enforcement, and disables outbound redirect following. No public exploit or CISA KEV listing identified at time of analysis.