A critical cache poisoning vulnerability in Eclipse Open VSX allows unauthenticated attackers to facilitate the delivery of malicious extensions to unsuspecting users.

The application insecurely constructs absolute URLs using unvalidated X-Forwarded request headers, allowing an unauthenticated attacker to inject malicious download and signature URLs into the server cache.

This vulnerability poses a severe risk to software supply chain integrity, as it enables the distribution of malicious code to developers and automated systems. A successful exploit results in the unauthorized installation of compromised extensions, potentially leading to full system compromise or data exfiltration. Given the CVSS score of 9.1, this flaw is categorized as critical due to the high impact on system integrity and the potential for widespread distribution of malicious artifacts.

Immediate Action: Configure the reverse proxy to overwrite, rather than relay, the X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers, and flush all cached entries immediately after applying the configuration change.

Proactive Monitoring: Monitor server access logs for anomalous X-Forwarded header values and review cache management logs for unexpected changes to extension metadata.

Compensating Controls: Ensure the Open VSX server is not directly reachable by clients and is only accessible through a properly configured, trusted reverse proxy that strips or sanitizes incoming header information.

Public Exploit Available: No (exploit_available unknown)

Due to the critical nature of this vulnerability and the potential for supply chain compromise, administrators must treat this as a high priority. Implement the specified reverse proxy configurations immediately to prevent cache poisoning, and verify that all cached content is purged to remove any existing malicious entries. Monitor for vendor updates to the Open VSX platform to apply a permanent software-based fix as soon as one becomes available.