writeups.xyz / Gitpod remote code execution 0-day vulnerability via WebSockets

Submitter : c2a

Date: 27 February 2023

Bounty : undisclosed

Vulnerabilities :

• RCE
• Cross-Site WebSocket Hijacking (CSWH)
• Samesite Cookie Bypass
• Account Takeover

Programs :

• Gitpod

Authors :

• Elliot Ward

Link :
https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/