Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CodeChecker versions up to 6.26.1 contain a buffer overflow vulnerability in the internal ldlogger library, which is executed by the CodeChecker log command. Details Unsafe usage of strcpy() function in the internal ldlogger library allows attackers to trigger a buffer overflow by supplying crafted inputs from the command line. Specifically, the destination buffer is stack-allocated with a fixed size of 4096 bytes, while strcpy() is called without any length checks, enabling an attacker to overrun the buffer. PoC Example script is included below to illustrate how this vulnerability can be exploited. Impact Any environment where the vulnerable CodeChecker log command is executed with untrusted user input is affected by this vulnerability.
Recommended action: Upgrade to 6.26.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
--- CodeChecker versions up to 6.24.5 contain an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL's path segment. This results in bypassing protections against CVE-2021-28861, leading to the same open redirect pathway. Details --- CodeChecker processes GET requests by first rewriting the path segment of the URL, and then passing the rewritten URL to the webserver framework. When trimming the product name from the URL, no sanitization was performed on the remaining URL, which reintroduced the same issue as CVE-2021-28861, leading to the same open redirect pathway using URLs such as /Default//attacker.com/%2f... Impact --- The vulnerability allows an attacker to create a hyperlink that looks like a legitimate CodeChecker URL, but redirects to an attacker-supplied website when clicked.
Recommended action: Upgrade to 6.24.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site request forgery allows an unauthenticated attacker to hijack the authentication of a logged in user, and use the web API with the same permissions. Details Security attributes like HttpOnly and SameSite are missing from the session cookie, allowing its use from XHR requests and form submissions. The CodeChecker API endpoints only require the session cookie, they do not require a CSRF token, and missing HTTP headers allow the form submission to succeed (but not XHR). This means that the attacker needs to know the ID of products to edit or delete them, but it does not need knowledge to create new products with the SQLite backend. PoC With a superuser logged into CodeChecker. Or the same form attack on any of the applicable endpoints. Impact The vulnerability allows an attacker to make requests to CodeChecker as the currently logged in user, including but not limited to adding, removing or editing products. The attacker needs to know the ID of the available products…
Recommended action: Upgrade to 6.24.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user is generated in a weak manner, cannot be disabled, and has universal access. Details Until CodeChecker version 6.24.1 there was an auto-generated super-user account that could not be disabled. The attacker needs to know only the username of the root user. This root user is unconditionally assigned superuser permissions. Which means that if any user via any service logs in with the root user's username, they will unconditionally have superuser permissions on the CodeChecker instance. The name of the user name can be found in root.user file in the CodeChecker configuration directory. You can check if you are impacted by checking the existence of this user in the external authentication services (e.g. LDAP, PAM etc.). Impact This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root…
Recommended action: Upgrade to 6.24.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. Details All endpoints, apart from the /Authentication is affected by the vulnerability. The vulnerability allows unauthenticated users to access all API functionality. You can look for the following pattern in the logs to check if the vulnerabilty was exploited: Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in Authentication, Configuration or ServerInfo and it was made by an Anonymous user. Impact This authentication bypass allows querying, adding, changing, and deleting Products contained on the CodeChecker server, without authentication, by an anonymous user.
Recommended action: Upgrade to 6.24.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ZIP files uploaded to the server-side endpoint handling a CodeChecker store are not properly sanitized. An attacker can exercise a path traversal to make the CodeChecker server load and display files from an arbitrary location on the server machine. Details Target The vulnerable endpoint is /<PRODUCTURL/v6.53/CodeCheckerService@massStoreRun. Exploit overview The attack is made possible by improper sanitization at one point in the process. 1. When the ZIP file is uploaded by CodeChecker store, it is first unzipped to a temporary directory (safely). 2. When deciding which files to insert into CodeChecker's internal database, the decision is made based on the contenthashes.json in the ZIP. An attacker has control over the contents of this file. 3. After reading that file, the paths specified in the JSON are normalized by this code: https://github.com/Ericsson/codechecker/blob/fa41e4e5d9566b5a4f5a80a27bddec73a5146f5a/web/server/codecheckerserver/api/massstorerun.py#L442-L444 4.…
Recommended action: Upgrade to 6.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
Recommended action: Upgrade to 6.18.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.