A critical CORS misconfiguration in the open-vsx.org service allows attackers to perform cross-site request forgery and exfiltrate sensitive user data including personal access tokens.

This issue involves an overly permissive CORS policy (CWE-942) where the server reflects the requesting origin while allowing credentials, effectively bypassing the same-origin policy. An attacker can trick a logged-in user into performing unauthorized actions, including the creation and exfiltration of personal access tokens, by chaining this vulnerability with CSRF.

The exposure of personal access tokens and sensitive user profile information poses a severe risk to the integrity of the open-vsx.org ecosystem. Given the CVSS score of 8.7, this represents a high-severity threat that could lead to unauthorized code publication or the deletion of namespaces. Successful exploitation results in complete account compromise for affected users, potentially leading to supply chain attacks if malicious extensions are published under legitimate namespaces.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators must verify their CDN and edge layer configurations to ensure the Access-Control-Allow-Origin header is strictly whitelisted and never reflects arbitrary origins when Access-Control-Allow-Credentials is set to true.

Proactive Monitoring: Review access logs for unusual patterns of cross-origin requests targeting the /user/ endpoints, particularly requests originating from unrecognized or external domains.

Compensating Controls: Implement a strict Content Security Policy (CSP) on the web application to restrict the domains from which scripts can be loaded and to which data can be sent, mitigating the impact of potential cross-site attacks.

Public Exploit Available: Unknown

Organizations utilizing open-vsx.org should treat this vulnerability with high urgency. Given the potential for token exfiltration and subsequent supply chain compromise, teams should audit user activity and rotate any personal access tokens created or modified during the affected timeframe. Monitor official Eclipse security channels for the release of a definitive software patch to remediate the CDN or application-level header configuration.