Technical impact
Eclipse Che dashboard backend exposes a POST /dashboard/api/data/resolver endpoint that forwards a caller‑supplied URL to an outbound HTTP GET request without any host filtering or redirection controls. The endpoint is reachable by any authenticated user, allowing the attacker to retrieve data from internal network addresses, including the cloud metadata service, loopback interfaces, private RFC‑1918 ranges, and in‑cluster Kubernetes services.
Affected Systems
Eclipse Foundation’s Eclipse Che platform components 7.79.0 through 7.121.0 are affected. The vulnerability is corrected in version 7.122.0, which introduces private‑address blocking, IPv4‑mapped IPv6 bypass prevention, enforcement of an operator‑configured allowlist (spec.devEnvironments.allowedSources.urls), and disables HTTP redirects outbound from the dashboard.
Risk and Exploitability
The CVSS score is 6.3, indicating a moderate severity. An authenticated user can exploit the SSRF to read sensitive internal information; the lack of host filtering or allowlist enforcement enables arbitrary target selection. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, implying it may not yet be actively exploited in the wild. The attack vector is likely internal or local network‑bound, depending on the user’s network context, but the vulnerability could potentially be leveraged from any environment where the dashboard is reachable and authentication credentials are known.
