External Control of System or Configuration Setting

Summary

Gitpod is vulnerable to Cookie Tossing due to a missing ''__Host- prefix" on the "_gitpod_io_jwt2_" session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker's own JWT so that specific actions taken by the victim (such as connecting a new GitHub organization) are actioned by the attacker's session. This vulnerability affects github.com/gitpod-io/gitpod package verisons prior to main-gha.26975, and @gitpod/gitpod-protocol package versions prior to 0.1.5-main-gha.26975.