CVE-2025-12999

*** Pendiente de traducción *** UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header. <br /> <br /> <br /> <br /> <br /> Those responses are cached under keys that do not include the host (extension.json since 0.6.0, namespace.details.json since 0.9.0, sitemap since 0.14.5, latest.extension.version.vscode since 0.34.2). A single request carrying a forged header therefore places attacker-chosen URLs into an entry served to every other client for the lifetime of that entry — one hour by default, and cluster-wide where ovsx.redis.enabled is set.<br /> <br /> <br /> <br /> The VSIX download URL, its signature URL and the public key URL are all derived from the same base URL, so extension signing does not limit the impact: an attacker who poisons an entry supplies the package, the signature over it, and the key used to verify it. <br /> <br /> <br /> <br /> Exploitability depends on deployment topology. A server reachable directly by clients, or fronted by a proxy that relays the client&amp;#39;s X-Forwarded-Host rather than overwriting it, is exploitable by an unauthenticated remote attacker. A proxy that overwrites the header is not.<br /> <br /> <br /> <br /> An unauthenticated attacker can poison Open VSX&amp;#39;s per-extension metadata cache with attacker-controlled download, signature, and public-key URLs by supplying a crafted X-Forwarded-Host header, causing downstream VS Code-compatible editors to fetch and install a malicious VSIX.<br /> <br /> <br /> <br /> Workarounds (unpatched versions)<br /> <br /> <br /> <br /> <br /> 1. Configure the reverse proxy to set rather than relay X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix — note that nginx&amp;#39;s $host is the client&amp;#39;s Host header and is not a safe value.<br /> <br /> <br /> <br /> 2. Ensure the server is not reachable except through that proxy.<br /> <br /> <br /> <br /> 3. Flush the caches afterwards; poisoned entries survive the configuration change.