VS Code Zero-Day Can Steal GitHub OAuth Tokens via Malicious Link
Summary
Researcher Ammar Askar released a proof-of-concept for an unpatched VS Code flaw that can steal GitHub OAuth tokens through a malicious link and enumerate accessible private repositories. Clearing github[.]dev site data can reduce risk.
Key points
- Researcher Ammar Askar released proof-of-concept code for an unpatched VS Code vulnerability with no assigned CVE.
- The exploit abuses the sandboxed webview message-passing system in github[.]dev to install a malicious extension.
- The extension can extract a GitHub OAuth token and use the GitHub API to enumerate private repositories accessible to the victim.
- The article says users can reduce risk by clearing browser cookies and local site data for github[.]dev, which prompts a sign-in warning when an exploit link is opened.
- Askar said he notified GitHub shortly before public disclosure and cited a prior negative experience with Microsoft's security response process.
Article Details
- Vulnerability Types
- Flaw in VS Code’s sandboxed webview message-passing system
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Clear cookies and local site data for github.dev in the browser.
MITRE ATT&CK
T1059.007 · JavaScriptThe proof of concept runs malicious JavaScript in a webview to simulate editor keypresses.T1204.001 · Malicious LinkThe exploit relies on a user clicking a malicious link.T1213.003 · Code RepositoriesThe proof of concept uses the extracted token to query the GitHub API and enumerate private repositories accessible to the victim.T1528 · Steal Application Access TokenThe exploit extracts the GitHub OAuth token passed to github.dev.
People
Vendors
GitHubA security researcher has released proof-of-concept exploit code for a VS Code zero-day that can steal GitHub OAuth tokens by luring users into clicking a malicious link.MicrosoftMicrosoft classifies a software flaw as a zero-day if it is publicly disclosed and/or actively exploited with no official patch currently available.
Products
GitHubA security researcher has released proof-of-concept exploit code for a VS Code zero-day that can steal GitHub OAuth tokens by luring users into clicking a malicious link.github.devThe flaw can be abused through github.dev to install a malicious extension and enumerate private repositories accessible to the victim.VSCodeA security researcher has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link.