[HN Gopher] RCE in Visual Studio Code's Remote WSL for Fun and N...
___________________________________________________________________
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
Author : gmemstr
Score : 305 points
Date : 2021-12-21 08:38 UTC (14 hours ago)
(HTM) web link (parsiya.net)
(TXT) w3m dump (parsiya.net)
| kerng wrote:
| A bug like this shows that there is probably no security reviews
| done at all in the VS Code team. This would be flagged right away
| in a threat model review. Quite worrying.
|
| Also, strange that this doesn't get a bug bounty payout - it's
| very severe.
| mikotodomo wrote:
| I don't get the video https://parsiya.net/blog/2021-12-20-rce-in-
| visual-studio-cod... He goes to the hacker website and then
| calculator opens?
| magicconch wrote:
| Kudos to the author for a fantastic write up. The structure made
| reading it a really pleasant learning experience - a solid table
| of contents, an up-front summary, and a sensible list of
| prerequisites and instructions for following along.
| turminal wrote:
| > Your editor has DRM
|
| Lovely
| 2ion wrote:
| In a sense Microsoft forgot its own learnings. Because of exactly
| things like this they prevent UWP apps from connecting to
| localhost by default and make it very annoying to circumvent and
| from my experience, the circumvention is not exactly a stable
| setup. So they really don't want you to do that, and somebody
| thought enough to make it extra difficult. So, they have UWP, all
| those well thought-out policies, then make an editor ecosystem
| out of web technology and throw everything out of the window. No
| surprise from a $T company with more teams than countries on
| Earth that not everything is coordinated, but they should have a
| guy with the required knowledge and sensibilities on any major
| product team. Apps installed from their "store" are relatively
| safe, but then they put a (extension) store inside their app
| again, which is unsafe :/
| easton wrote:
| Apps installed from the Microsoft Store are no longer
| guaranteed safe, as Win32 apps can be added to the store now
| and installed via winget. There's static analysis and they run
| the installer, but if it does something stupid after the
| install they can't automatically detect it.
| garren wrote:
| Don't the win32 apps restrict the calls in that subsystem
| that one can access?
|
| I recall looking into this a while back with the intention of
| leveraging it for an ancient win32/mfc app. I don't remember
| the specifics, but I seem to recall that MS restricted or
| prevented access to a rather substantial subset of win32.
| WorldMaker wrote:
| Not anymore. Microsoft gave up on trying to sandbox Windows
| Store installs for Win32 apps.
| withinrafael wrote:
| And it was unsafe for a few years prior to this event too,
| with the introduction of Desktop Bridge apps (packaged Win32
| hybrid apps running with full trust).
| SahAssar wrote:
| Not making websockets follow the same-origin policy was a
| mistake.
| kevincox wrote:
| This websocket was also listening on external interfaces so a
| non-browser client could have sent whatever headers it wanted.
| ravenstine wrote:
| In fairness, couldn't the same things still be accomplished
| with cross-origin POST/GET requests? Not that there isn't some
| regretability to not making those strictly same-origin as well.
| willbudd wrote:
| I suppose that case can be made, but in this case the direct
| cause of the vulnerability is the WebSocket server not checking
| the HTTP Origin header in direct violation of the standard
| (RFC6455), which is spells out at that doing so is a MUST. I
| could maybe understand whitelisting localhost and file URLs,
| but giving a carte blanche -on every single interface no less-
| is just absurdly negligent.
| christophilus wrote:
| What is the best alternative for TypeScript development? My
| favorite light-weight editor is Kakoune, but it really doesn't
| have enough plugins for the kind of work I do.
| mrtnpwn wrote:
| Sublime Text 4 with LSP-TypeScript is really nice. The official
| package that Microsoft ships with the TypeScript Language
| Server tends to stop working after a while... I'm not sure why
| but that's that.
| VPenkov wrote:
| Probably one of the JetBrains products, e.g. WebStorm or IDEA.
| DangitBobby wrote:
| Webstorm is quite good. Better than VsCode, in my opinion. I
| use PyCharm while working on a Django/React monolith and I
| would say even that is better for TS than VsCode.
| bsenftner wrote:
| I've only been using VSC for about 6 months. During my the first
| week of use, I noted how insecure all the plugins and their
| communications with the main application were set up. Dismayed, I
| moving the workstation to an airgapped portion of my environment,
| and the piece of shit would not work without a net connection. So
| I use VCE inside a VM now. My career includes working for
| security companies with sensitive information and documents...
| VSC needs some serious redesigning with multiple experienced
| security engineers on the team.
| turminal wrote:
| Why not just use some other editor?
| bsenftner wrote:
| I've been trying several editors, but VSC has the best
| integrated debugging, after Visual Studio itself - I use the
| free Visual Studio Community version. I'm primarily a C++
| developer, but over the last 6 month have been doing a deep
| dive on machine learning with Python, and that is why I even
| bothered with VSC. The available guidance on setting up a
| Python development environment in VSC is abundant, while the
| same in Visual Studio IDE is significantly less, with scant
| troubleshooting support. I tried Visual Studio IDE for my
| Python work at first, but switched to VSC after issues.
| foobarbaz33 wrote:
| Sounds like he has. VCE, Visual Studio Enterprise
| kube-system wrote:
| Visual Ctudio Enterprise?
| symlinkk wrote:
| Is this specific to WSL or does it work with other Remote types
| (SSH)?
| Karliss wrote:
| Issues like this have been repeated countless times in various
| IDEs, debugger interfaces and local services using browser as UI.
| Developers need to stop using network sockets as IPC channels for
| local services unless browsers significantly increase the
| restrictions on cross site requests. Similar situation with
| regular CSRF attacks. And it needs to be opt out not opt in. As
| long it's a responsibility of developer to implement proper
| authentication checks for something they consider a local service
| vulnerabilities like this will keep appearing.
| silon42 wrote:
| Also, using browser as UI should not mean downloading JS ever.
| stefan_ wrote:
| > Browsers need to stop connecting to anything other than
| what's typed into the navigation bar.
|
| Yes, indeed!
| seoaeu wrote:
| A web browser that doesn't support links isn't much of a web
| browser
| e12e wrote:
| ... Or images? I suppose one might enforce a draconian
| same-origin policy.. But that would no longer be "the web"
| I think.
| faeyanpiraat wrote:
| Explicitly clicking on a link is almost like typing it in
| the url bar, so that can be an exception
| Xelbair wrote:
| oh how i would love this future.
| hdjjhhvvhga wrote:
| Unfortunately, the companies that control today's web have
| a different view, and they are the ones in charge.
| cryptonym wrote:
| At this point of time, I give it 10min before we get a
| magic_proxy nginx module, then your script src will be /mag
| ic_proxy/www.evilthirdpary.com/slow_multi_megabyte_script.j
| s
|
| You can still import all nasty third parties required by
| marketing department, bypassing first party protections and
| leading to even worse security. Or maybe maintain allow
| lists, basically that's a Content Security Policy.
|
| Future is now old man.
| Pxtl wrote:
| At least then the server has to deal with the security
| implications of talking directly to the advertiser,
| instead of pushing the risk wholly to the client.
| cryptonym wrote:
| In the end the script is running on client, dealing with
| user data, not server data. Client is still taking the
| risk.
|
| On moral/legal issues, integrating script from third or
| first party hostname sounds like technical detail. If you
| select partner to run their code on your pages, you
| should be responsible checking user consent when
| applicable and taking responsibility. British Airways has
| been fined PS20m even if that script was not on their
| servers.
| MarkSweep wrote:
| This already here, but made with a subdomain that CNAMEs
| to a tracker domain:
|
| https://arxiv.org/abs/2102.09301
| Xelbair wrote:
| sure, but as other person stated -servers deals with
| that, and all legal implications about data protection
| apply to them - it's harder to weasel out of it that way.
| nine_k wrote:
| What if browsers learned to connect to Unix sockets? And
| windows named pipes? And users could control these endpoints by
| the usual filesystem permissions?
|
| One can dream.
| meepmorp wrote:
| Isn't this more or less the idea behind plan 9?
| Arnavion wrote:
| You don't even need Windows named pipes. Windows supports
| AF_UNIX since 10.
| turminal wrote:
| More scope creep?
|
| Browser are already way too big.
| scandinavian wrote:
| > And it needs to be opt out not opt in
|
| In this case it's an extension that's not installed by default.
| Karliss wrote:
| I am talking about default behavior of browsers and network
| libraries used to implement services listening to network
| requests.
|
| Not whether installing an extension whose purpose is
| interacting between locally running IDE and locally running
| VM can be considered opting in it interacting with network in
| any way.
| formerly_proven wrote:
| In this case the application used websockets, which is
| supported by browsers natively - but another thing to keep in
| mind is that any website can send somewhat controlled HTTP
| requests (not subject to CORS/preflight) to just about
| anything, regardless of if that's an HTTP server or not. If the
| receiving side is permissive enough, things might happen.
| Possibly unwanted things.
| 8organicbits wrote:
| > Does it fix the issues? Yes.
|
| > Do I think there are other security issues here and we can
| bypass this? Also, yes.
|
| > Do I want to spend more time doing free work for a company with
| a 2.5 TRILLION market cap? Hell, no.
|
| Troubling.
| SamuelAdams wrote:
| Not really all that troubling, all the author is saying is that
| he wants to get paid for their work.
|
| Either Microsoft or other future vendors can actually honor an
| established bug bounty program, or the author can sell his
| findings to the highest bidder. Or the author can simply not
| spend time and energy finding bugs in the first place.
| oaiey wrote:
| Highest bidder is unethical and illegal.
|
| But does not change the monetary reality
| artful-hacker wrote:
| How is it illegal?
| rajin444 wrote:
| Pass a law that requires companies to pay black market
| value for bug bounties. It's also unethical for big
| corporations to exploit the US oligarchy to get these fixes
| for free.
| shukantpal wrote:
| There's no exploitation going on.
| 8organicbits wrote:
| Don't miss the middle statement; the author thinks there are
| further attacks here, even with the fix. Others can also find
| and then choose to report/sell at their own discretion.
| azalemeth wrote:
| The "Your editor has DRM" section alone [0] is enough for me to
| continue to advocate for a better user-friendly FOSS IDE, in
| addition to the wonderful giants of emacs & vim, and to avoid the
| VS Code "kool aid".
|
| [0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-
| cod...
| vorpalhex wrote:
| VSCodium is a FOSS build of the MIT VSCode repo, with an
| alternate FOSS compliant extension source. Note that some fancy
| extensions are missing, but otherwise works 100%. I have been
| using VSCodium as my main IDE for about a year now.
|
| https://vscodium.com/
| j0057 wrote:
| One of those extensions is the one that implements C#
| debugging, so for C# debugging, VSCodium is a fancy editor,
| not an IDE.
| jodrellblank wrote:
| VS Code is MIT Licensed - https://github.com/Microsoft/vscode
|
| Arguably the MIT license gives you more Freedom than the GPL'd
| Linux kernel or GNU utilities. Trying to draw a distinction
| between "evil user-unfriendly Microsoft stuff" and "Holy
| Saviour FOSS" is not meaningful anymore.
| throw10920 wrote:
| _Some_ parts of VSCode are MIT Licensed - _not_ all of it,
| and in particular, parts of the standard VSCode that almost
| everybody downloads are straight-up proprietary, per the
| article[1].
|
| [1] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-
| cod...
| jodrellblank wrote:
| > " _Some parts of VSCode are MIT Licensed - not all of it_
| "
|
| The source code, the editor are. This is like Oracle
| releasing a proprietary plugin for EMACS and distributing
| it on Oracle Linux, and someone saying "this is bad, we
| need FOSS editors!". That wouldn't make EMACS not-FOSS.
|
| (Is it trolling of me to point out that of course the thing
| people _actually want_ is not the FOSS bit? There are
| dozens of editors, people want features not ideology)
| throw10920 wrote:
| Emacs' TRAMP is remote-access like VSCode server - except in
| addition to being _completely_ open-source, it also doesn 't
| require that you install anything on the server, which ranges
| from being annoying to a show-stopper in corporate
| environments.
|
| However...I love Emacs, but as much as I hate to admit it,
| VSCode's out-of-the-box experience is significantly better than
| even starter kits like Doom and Spacemacs ):
|
| VSCode is far more "user-friendly" than Emacs or Vim at this
| point in time. That's definitely something that can be changed,
| but let's not delude ourselves...
| Jerrrry wrote:
| Microsoft has the best bounty hunter program: go fuck yourself.
|
| If you find a way to take over MS accounts, or force email swaps,
| or even gamertag shanaigans, there is too much money to be made,
| there is not even a point for a bug bounty.
|
| It's like a $40 reward for returning a purse filled with $250k.
|
| I agree with OP: no more free bugs.
| [deleted]
| jodrellblank wrote:
| Make bug bounties pay $250k and people will have their friend
| inside add some bugs for the outsider to find, and share the
| payday.
|
| Pay-per-bug-found incentivises plenty of counterproductive
| things as well, especially if we're talking about people who
| happily sell to anyone on the black market.
| darkarmani wrote:
| You can do that today with blackmarket exploits, so why do
| you think actual bug bounties will cause this problem?
| Debug_Overload wrote:
| It's not just Microsoft. What most bug bounties pay isn't even
| close to the amount you can get from selling it on the black
| market (assuming you have the right connections). It's why
| selling exploits to nation states and vendors who work with
| them is so lucrative.
| _wldu wrote:
| I do agree that bug bounties are too small, but isn't selling
| bugs on the black market illegal?
|
| I would much rather get $40 dollars for a bug and some public
| acknowledgement (which I could use to get a better paying
| job) than to sell it for criminal use.
| pixl97 wrote:
| Assuming you live in a place where you can get a high
| paying job and/or leave the country to get one.
|
| Taking a US centric view on this is a great way to ensure
| nation states have compromised your security.
| tw04 wrote:
| So if you take a non-US centric view and assume there's
| no legal repercussions and the person finding the bug has
| no moral compass, what exactly would prevent them from
| sharing the bug with a nation state and you at the same
| time? Sure they may get slightly less from the nation
| state because the bug would have a shorter shelf life,
| but it would still make it into the wild long before
| every system could be patched.
|
| Paying more money isn't going to make someone do the
| right thing.
| Debug_Overload wrote:
| The legal/ethical question is important, but I was just
| stressing OP's point about the disparity between bug
| bounties and what the actual exploits are worth. IANAL, but
| for the specific cases I mentioned (nation states and
| vendors who work with them), I think the legal aspect would
| be very different from selling it to regular black market
| cybercriminals (I used the generic "black market" in the
| first part of the original comment but I was mostly talking
| about those two cases).
| darkwater wrote:
| > but isn't selling bugs on the black market illegal?
|
| Noob question: is there any specific law that punishes
| describing how to get into a software/electronic system but
| not actually doing it? Something that is just not purely
| US-centric.
| ensignavenger wrote:
| Here is UK specific answer, and as they point out, if you
| sell to some one knowing they are going to commit a crime
| with it, you can be considered an accomplice in many
| jurisdictions.
|
| https://law.stackexchange.com/questions/11552/is-it-
| illegal-...
| kube-system wrote:
| Sounds like a market opportunity for middlemen in other
| jurisdictions.
| voakbasda wrote:
| Or, sell it on the black market, and use that connection to
| get a better job on the black market. Reputation is just as
| important for criminals, and crime pays better (until you
| get caught).
| msoad wrote:
| Bitcoin solves this!
| nostoc wrote:
| How about selling legally to a state actor for 100k ?
|
| Bug bounties need to be higher, because the black market is
| not the only alternative.
| [deleted]
| anonymousDan wrote:
| How does the black market price compare to the 'nation state'
| price?
| saruken wrote:
| x = y. Where do you think nation states purchase their
| tools?
| rafale wrote:
| It's probably illegal in many jurisdictions, no? Not to
| mention unethical. You are not just harming Microsoft here in
| this instance, but potentially millions of people.
| gopher_space wrote:
| If we're looking at ethics, what's the morality of
| Microsoft _not_ paying market rate for exploits.
| adolph wrote:
| Bug bounties probably act as a price discovery mechanism on
| the part of bug finders. They should also have a negative
| price premium bye to decreased risk.
| nur23kg wrote:
| [deleted]
| moritonal wrote:
| Could someone with insight give an estimate for how much you
| could sell an exploit like this, which let's you RCE a fair bunch
| of developer machines?
|
| It feels that paired with a good blog (ironically about WLS) this
| could be very profitable, compared to the $0 MS awarded them.
| rfoo wrote:
| Fortunately, demand for such bugs is pretty low ^, so, $1~2k I
| guess.
|
| ^ this is both a good and a sad indicator, it means the bar of
| post-exploitation for such a bug (on developers' boxes) is
| "sufficiently high" that your favorite ransomware gangs are not
| eager to get on. OTOH it means they have way more "easier"
| enterprise-y targets...
| rabite wrote:
| I just asked around, I immediately had someone who I've sold
| exploits to tell me I could field 45k for a bug like this.
| There's a lot of conditions to selling exploits -- the biggest
| being that you don't get to blog about what you sell. But it is
| real money.
| stonepresto wrote:
| Your feeling is correct, although as other comments have
| mentioned it depends greatly on how you market it and to whom.
| Probably well above $5-10k though.
|
| Bug bounty is good in some respects, but the people who profit
| the most from it are the companies and platforms. IMO it feels
| dirty to exploit people's good intentions and ethics (reporting
| vs selling) for profits, but that's corporations for you.
| gostsamo wrote:
| Just say "supply chain attacks" and the price can reach
| millions.
| gigel82 wrote:
| If I'm reading this right, it assumes the machine's IP is
| publicly accessible over the internet; which I'm guessing -even
| with IPv6- is not the case in 99.999% of cases; who just exposes
| their development machine directly to the internet with a public
| IP?
|
| Still bad, but not quite as bad as owning from the browser via
| localhost GET.
| ectopod wrote:
| No, JavaScript running in your browser can connect to it. No
| remote access required. Of course, if you do allow remote
| access it is even worse.
| dboreham wrote:
| Wait, the browser allows random http connections to localhost
| from JS fetched from any domain??
|
| Edit: after reading tfa, it appears: no it can't , but it may
| due to browser security vulnerabilities.
| nitrogen wrote:
| Do browsers block access to 192.168/16 or 10/8 etc?
| AntonyGarand wrote:
| It does, if the server accepts the connection there is
| nothing preventing it.
|
| This is frequently used by apps which are installed on your
| machine but are accessed by links, such as zoom and
| discord. I think Zoom removed its server after receiving
| pressure[0] about it, but discord still does it: Head to
| https://discord.com/invite/test and it should open your
| local discord client, or checking the network requests will
| reveal up to 10 attempted local ports.
|
| [0] https://www.zdnet.com/article/zoom-defends-use-of-
| local-web-...
| [deleted]
| fulafel wrote:
| This guess would be incorrect both in the percentage, and in
| the assumption that this would be required for exploitability.
| FundementalBrit wrote:
| I'd have taken a trip down to Buenos Aires and sold it.
| pritambarhate wrote:
| I am not 100% sure, but wouldn't that be a crime under the laws
| of many countries? If someone left their car unlocked with keys
| next to your house. Will you also steal it and sell it to
| somebody?
| Skunkleton wrote:
| The crime here would be more along the lines of selling the
| information that you leave your car unlocked with the keys
| next to your house.
| dspillett wrote:
| While most of me likes the idea of being paid good money for my
| efforts, or even for doing nothing if I can get away with it, a
| rather pesky part of me (a nagging entity that calls itself "a
| conscience") would take _all_ the fun out of doing it by
| enabling harm to others (via selling information on possible
| exploits, for instance).
|
| The other blockers of course being that I have neither the
| skills nor the time to find such flaws in the first place!
|
| It is true that there are people out there who do have the
| skills, and the time, and would be fine with selling their
| results to third parties, so maintainers (particularly those
| publishing widely used projects), would do well to treat people
| who practise safe disclosure with sufficient inducement to keep
| doing so.
| ackbar03 wrote:
| meh, if you don't do it someone else will.
| dspillett wrote:
| I prefer to judge others by standards I keep myself, rather
| than slipping mine towards the lowest common denominator.
| Both because it is morally right IMO and, I must admit,
| because I like feeling a little superior.
| nkrisc wrote:
| Only if everyone takes that attitude.
| tata71 wrote:
| Individual Humanism will return.
|
| It's long overdue.
| johnday wrote:
| It is generally held that "Defect" is not the optimal
| strategy in the Prisoner's dilemma, and that seems to be
| what you're arguing for here, or something analagous to it.
|
| Follow the golden rule.
___________________________________________________________________
(page generated 2021-12-21 23:01 UTC)