VS Code Flaw Lets Malicious Notebooks Steal GitHub Tokens
Summary
A crafted Jupyter notebook opened on github[.]dev can install a malicious extension that steals GitHub tokens. Microsoft says its services are mitigated; the desktop version appears unpatched and may allow remote code execution.
Key points
- A researcher disclosed the vulnerability and a proof-of-concept exploit publicly; Microsoft released a fix the following day.
- On github[.]dev, opening a link to a crafted Jupyter notebook can trigger hidden code that simulates keystrokes to install a malicious extension.
- The extension can steal a GitHub access token, which could provide read and write access to repositories available to the victim, including private repositories.
- The user is notified about the extension’s access request only if github[.]dev has not been used before.
- The attack also affects desktop VS Code, but requires additional victim interaction; the article says that version appears unpatched and the attack could enable remote code execution.
- Microsoft told SecurityWeek that the issue was mitigated for its services and no customer action was required.
Article Details
- Vulnerability Types
- GitHub access-token theft through installation of a malicious VS Code extension
- Remote code execution on devices running the desktop version of VS Code
- Severity
- Severe
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- partial
MITRE ATT&CK
T1176 · Software ExtensionsThe hidden code simulates keystrokes to install a malicious extension in VS Code.T1204.001 · Malicious LinkA user clicking a link to the malicious notebook is described as the only requirement to trigger the attack.T1204.002 · Malicious FileThe attack relies on a victim opening a specially crafted Jupyter notebook containing hidden code.T1528 · Steal Application Access TokenThe malicious extension steals the victim’s GitHub access token, which the attacker can use to access repositories.
People
Vendors
Products
GitHubA security researcher has disclosed details of a severe Visual Studio Code (VS Code) vulnerability that can be exploited to steal a user’s GitHub token and access their repositories.github.devhole involves an attacker creating a specially crafted Jupyter notebook. When someone opens it on github.dev, a lightweight version of VS Code that runs entirely in the web browser, hidden code inside theVSCodeA security researcher has disclosed details of a severe Visual Studio Code (VS Code) vulnerability that can be exploited to steal a user’s GitHub token and access their repositories.