Force.com Workbench Remote Code Execution Vulnerability via Malicious Cookie in Timezone Conversion

A remote code execution vulnerability has been identified in Force.com Workbench versions prior to 65.0.0. The issue arises in the timezone conversion process, which improperly handles attacker-controlled cookie values, allowing for exploitation.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Workbench is running.

Remediation

Users are advised to upgrade to Workbench version 65.0.0 or later. The vulnerability has been patched in this version by replacing deprecated functions with anonymous closures and adding input validation for cookie-based configuration values.