Collected research

Gitpod remote code execution 0-day vulnerability via WebSockets

Elliot Ward · Snyk Labs · 27 February 2023

Explains a Gitpod Cross-Site WebSocket Hijacking chain in which an attacker workspace shares the registrable site with the authenticated dashboard. SameSite cookies accompany the cross-origin WebSocket, exposing JSON-RPC methods that add an SSH key and take over workspaces and connected source control.

Record

Researcher

Elliot Ward

Published by

Snyk Labs

Date

27 February 2023

In the archive

• Collected in the 2023 research round

Tags

• websocket
• csrf
• session-cookie
• auth-bypass
• cloud
• attack-chain
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Elliot Ward, first published at the original source. Preserved copies are kept so the citation survives its host.