Executive Summary

The Eclipse OpenVSX Registry is vulnerable to a stored cross-site scripting (XSS) attack because it does not properly sanitize SVG files uploaded as extension icons.

An attacker can upload a malicious SVG icon that contains executable scripts. When a user navigates directly to the icon URL, the script executes.

This vulnerability arises because the SVG files are served with the Content-Type 'image/svg+xml' but without security headers like Content-Security-Policy or Content-Disposition: attachment.

Useful 0 Not Useful 0

Impact Analysis

The impact depends on the deployment type of the OpenVSX Registry.

• On deployments using local storage, the malicious script executes within the OpenVSX application origin, enabling attackers to hijack user sessions, steal authentication tokens, and publish unauthorized extensions.
• On deployments using external storage (such as open-vsx.org with an S3-backed CDN), script execution is confined to the storage origin, which reduces the impact but still allows phishing attacks and credential harvesting through attacker-crafted pages.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying whether malicious SVG files are uploaded as extension icons and if these SVG files are served without proper security headers.

You can check for SVG files being served with the Content-Type: image/svg+xml header and verify if security headers such as Content-Security-Policy or Content-Disposition: attachment are missing.

Commands to detect this might include using curl or wget to fetch the icon URLs and inspect HTTP headers, for example:

• curl -I https://your-openvsx-registry-url/path/to/extension/icon.svg
• Look for the Content-Type header and check for absence of Content-Security-Policy and Content-Disposition headers.

Additionally, scanning your storage or database for SVG files uploaded as extension icons can help identify potentially malicious files.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves preventing the upload and serving of SVG files as extension icons.

The vulnerability has been addressed in OpenVSX version 0.34.1 by rejecting SVG files as extension icons by default.

• Upgrade your OpenVSX Registry deployment to version 0.34.1 or later.
• If upgrading is not immediately possible, implement server-side validation to block SVG files from being uploaded as extension icons.
• Configure your web server or CDN to add security headers such as Content-Security-Policy and Content-Disposition: attachment when serving SVG files.
• Review and remove any existing malicious SVG icons from your storage.

Useful 0 Not Useful 0