Open Vsx Org
Monthly
Credentialed cross-origin reads and namespace takeover were possible against the hosted open-vsx.org registry because its CDN/edge layer reflected the requesting Origin back in Access-Control-Allow-Origin while simultaneously emitting Access-Control-Allow-Credentials: true on authenticated /user/ endpoints. A page on any origin could then issue credentialed requests in a logged-in user's browser and read the responses, exposing /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name}, /user/namespace/{name}/members and - critically - /user/csrf; with the CSRF token readable, the write-endpoint protection collapsed, and chaining /user/csrf with /user/token/create let the attacker page mint and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces. Attackers need no authentication of their own (CVSS 4.0 PR:N) and only passive victim interaction - the victim must be logged in to open-vsx.org and visit the attacker's page - while no public exploit code has been identified at time of analysis.
Credentialed cross-origin reads and namespace takeover were possible against the hosted open-vsx.org registry because its CDN/edge layer reflected the requesting Origin back in Access-Control-Allow-Origin while simultaneously emitting Access-Control-Allow-Credentials: true on authenticated /user/ endpoints. A page on any origin could then issue credentialed requests in a logged-in user's browser and read the responses, exposing /user (login name, avatar, homepage, tokens URL), /user/tokens, /user/namespaces, /user/extensions, /user/search/{name}, /user/namespace/{name}/members and - critically - /user/csrf; with the CSRF token readable, the write-endpoint protection collapsed, and chaining /user/csrf with /user/token/create let the attacker page mint and exfiltrate a personal access token carrying publish and delete rights over the victim's namespaces. Attackers need no authentication of their own (CVSS 4.0 PR:N) and only passive victim interaction - the victim must be logged in to open-vsx.org and visit the attacker's page - while no public exploit code has been identified at time of analysis.