Description
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout. This issue affects tidewave: from 0.8.0 before 0.9.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tidewave-ai tidewave
Default version status: unaffected
0.8.0 to < 0.9.2affected
pkg:hex/tidewavetidewave-ai tidewave
Default version status: unaffected
f78352b56d19cd4ae49999aa385011cef73e8b93 to < 80159536f752dc4d34797934d1516f29cea12b50affected
pkg:github/tidewave-ai/tidewave_phoenix