CyberRota Analysis
AI-GeneratedEclipse Theia versions up to 1.69.0 are vulnerable due to a flaw that allows automatic execution of git commands when opening a folder, without requiring user trust, potentially leading to arbitrary command execution from an attacker-controlled `.git/config`. This vulnerability primarily impacts applications built on Theia that utilize git integration, making it crucial for developers and organizations using these versions to prioritize updates to version 1.70.0 or later, where the issue has been mitigated. Users should be particularly vigilant if they are working with untrusted repositories, as exploitation could occur simply by cloning and opening such repositories in a Theia-based environment.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own `@theia/git` extension and the builtin VS Code `git` extension run git commands such as `git status` as soon as a repository is detected. Since git honors repository-local configuration, a folder containing an attacker-controlled `.git/config` with `core.fsmonitor` (or a comparable hook-like setting) causes the configured command to be executed. The configuration can be delivered by burying a bare repository inside a regular repository (OVE-20210718-0001), so cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with the privileges of the user, without any confirmation prompt. As of 1.70.0, plugins that declare `capabilities.untrustedWorkspaces.supported: false`, which includes the builtin git extension, are no longer loaded or activated in an untrusted workspace, and the deprecated `@theia/git` extension has been removed, so no git command is executed against an untrusted folder.