The value of hashed-password can be used to open CodeServer directly, which has security problem
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- typescript
- Domain
- authentication, security
Research direction
Start by tracing how the auth setting in ~/.config/code-server/config.yaml is read and how the code-server-session cookie is validated after the login page. Reproduce the behavior with the listed code-server command and jupyter_server_proxy URL, then verify that the hashed-password value cannot itself authenticate a session.
Written by the indexing model from the issue text.
Description
Is there an existing issue for this?
- I have searched the existing issues
OS/Web Information
- Web Browser: Chrome 143.0.7499.170
- Local OS: windows
- Remote OS: ubuntu 22.04, jupyterlab service
- Remote Architecture: x86
code-server --version: v4.108.0
Steps to Reproduce
- prepare "hashed-password" using command
echo -n "xxx" | npx argon2-cli -e - edit ~/.config/code-server/config.yaml，auth: password， hashed-password:"$argon2i$v=19$m=4096,t=3,p=1$xxx$xxx"
- start code-server using command
code-server --port 7756 - using jupyter_server_proxy to visit code-server service, concatenate a URL as https://base_url/proxy/7756/
- when the code-server login page occurs, skip input the xxx into the password area. F12 edit the application cookie, set key=code-server-session, value="$argon2i$v=19$m=4096,t=3,p=1$xxx$xxx", refresh the browser
Expected
Failed to login into the code-server. The hashed-password in the config.yaml should not be the plain credentials
Actual
successfully login into the code-server
- Dominant language
- TypeScript
- Stars
- 79.4k
- Forks
- 6.9k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coder/code-server
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
coder/code-server#8017 · 2 comments ·
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
coder/code-server#8013 · 4 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7976 · 2 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7962 · 3 comments ·
-
bug needs-investigation
Difficulty 4/5 3-5 days Newbie friendliness 55/100
coder/code-server#7955 · 1 comment ·
All issues in coder/code-server
Similar issues
-
VerificationGate: ATTRIBUTION quote guard never matches a normal quotation (\b around the quote) Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
danielmiessler/LifeOS#2234 ·
-
T: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Mend: dependency security vulnerability untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 70/100