CVE-2022-41042
published 2022-10-11CVE-2022-41042: Visual Studio Code Information Disclosure Vulnerability
PriorityP336high7.4CVSS 3.1
AVNACLPRNUIRSCCHINAN
EPSS
1.92%
77.5th percentile
Visual Studio Code Information Disclosure Vulnerability
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_studio_code | >= 1.0.0 < 1.72.1 | 1.72.1 |
| msrc | visual_studio_code | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
vendor_msrc7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Trailofbits
Escaping well-configured VSCode extensions (for profit)
blogs_trailofbits·2023-02-23·CVSS 7.4
[HIGH] Escaping well-configured VSCode extensions (for profit)
In part one of this two-part series, we escaped Webviews in real-world misconfigured VSCode extensions. But can we still escape extensions if they are well-configured?
In this post, we’ll demonstrate how I bypassed a Webview’s `localResourceRoots` by exploiting small URL parsing differences between the browser—i.e., the Electron-created Chromium instance where VSCode and its Webviews run—and other VSCode logic and an over-reliance on the browser to do path normalization. This bypass allows an attacker with JavaScript execution inside a Webview to read files anywhere in the system, including those outside the `localResourceRoots`. Microsoft assigned this bug `CVE-2022-41042` and awarded us a bounty of $7,500 (about $2,500 per minute of bug finding).
## Finding the issue
While exploiting
Trailofbits
Escaping well-configured VSCode extensions (for profit)
blogs_trailofbits·2023-02-23·CVSS 7.4
CVE-2022-41042 [HIGH] Escaping well-configured VSCode extensions (for profit)
In part one of this two-part series, we escaped Webviews in real-world misconfigured VSCode extensions. But can we still escape extensions if they are well-configured?
localResourceRoots
localResourceRoots
CVE-2022-41042
## Finding the issue
localResourceRoots
From last post ’s SARIF viewer exploit, we learned that you can always exfiltrate files using DNS prefetches if you have the following preconditions:
link
connect-src
.vscode-resource.vscode-cdn.net
fetch
localResourceRoots
localResourceRoots
localResourceRoots
https://file+.vscode-resource.vscode-cdn.net
Example of how to fetch a file from a VSCode extension Webview
localResourceRoots
/etc/passwd
/../../../../../etc/passwd
/[valid_root]/../../../../../etc/passwd
As I expected, this didn’t work. The browser normal
Trailofbits
Escaping misconfigured VSCode extensions
blogs_trailofbits·2023-02-21·CVSS 7.4
CVE-2022-41042 [HIGH] Escaping misconfigured VSCode extensions
TL;DR: This two-part blog series will cover how I found and disclosed three vulnerabilities in VSCode extensions and one vulnerability in VSCode itself (a security mitigation bypass assigned CVE-2022-41042 and awarded a $7,500 bounty). We will identify the underlying cause of each vulnerability and create fully working exploits to demonstrate how an attacker could have compromised your machine. We will also recommend ways to prevent similar issues from occurring in the future.
A few months ago, I decided to assess the security of some VSCode extensions that we frequently use during audits. In particular, I looked at two Microsoft extensions: SARIF viewer, which helps visualize static analysis results, and Live Preview, which renders HTML files directly in VSCode.
Why should you care abou
Trailofbits
Escaping misconfigured VSCode extensions
blogs_trailofbits·2023-02-21·CVSS 7.4
CVE-2022-41042 [HIGH] Escaping misconfigured VSCode extensions
TL;DR: This two-part blog series will cover how I found and disclosed three vulnerabilities in VSCode extensions and one vulnerability in VSCode itself (a security mitigation bypass assigned CVE-2022-41042 and awarded a $7,500 bounty). We will identify the underlying cause of each vulnerability and create fully working exploits to demonstrate how an attacker could have compromised your machine. We will also recommend ways to prevent similar issues from occurring in the future.
A few months ago, I decided to assess the security of some VSCode extensions that we frequently use during audits. In particular, I looked at two Microsoft extensions: SARIF viewer, which helps visualize static analysis results, and Live Preview, which renders HTML files directly in VSCode.
Why should you care abou
2022-10-11
Published