A security researcher has released proof-of-concept exploit code for an unpatched Visual Studio Code zero-day vulnerability that could allow attackers to steal GitHub authentication tokens by tricking users into clicking a malicious link.
Microsoft considers a flaw a zero-day when it has been publicly disclosed or actively exploited before an official patch is available. In this case, the issue affects github.dev, the browser-based version of Visual Studio Code that lets users work directly on GitHub repositories.
Security researcher Ammar Askar explained in a blog post on Tuesday that the vulnerability abuses VS Code’s sandboxed webview message-passing system. According to Askar, an attacker can use malicious JavaScript inside a webview to simulate keypresses in the main editor and install a harmful extension. That extension can then extract the GitHub OAuth token passed to github.dev and use it to query the GitHub API.
Askar said the token is not limited to the specific repository the user opened. Instead, it can provide access to every private repository the victim is allowed to access, making the flaw especially dangerous for developers and organizations using GitHub for private code.
The exploit works because github.com sends an OAuth token to github.dev so the browser-based editor can interact with GitHub on the user’s behalf. Once stolen, that token can be abused to list private repositories and potentially expose sensitive code or project information.
The vulnerability has not yet been patched and has not been assigned a CVE ID. Until a fix is available, users can reduce the risk by clearing cookies and local site data for github.dev in their browser. This can be done by clicking the Settings icon in the browser’s address bar, then going to Cookies and site data and managing on-device site data. After clearing this data, users should see a warning asking whether the “GitHub Repositories” extension wants to sign in using GitHub when they click a potentially risky link.
Askar said he notified GitHub one hour before publicly disclosing the bug. He said the short notice was mainly a courtesy and explained that he chose full public disclosure because of previous negative experiences with Microsoft’s security response process. According to Askar, a previously reported VS Code issue was silently fixed without credit or acknowledgment of its security impact.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The disclosure comes at a time when Microsoft is already facing criticism over how it handles vulnerability reports. Another researcher using the online name “Nightmare Eclipse” has recently disclosed several Microsoft zero-days after expressing frustration with the Microsoft Security Response Center. Some of those flaws have reportedly been exploited in attacks.
