RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
1–10 of 109 posts
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#2Could someone with insight give an estimate for how much you could sell an exploit like this, which let's you RCE a fair bunch of developer machines?
It feels that paired with a good blog (ironically about WLS) this could be very profitable, compared to the $0 MS awarded them.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#3I'd have taken a trip down to Buenos Aires and sold it.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#4Not making websockets follow the same-origin policy was a mistake.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#5Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to implement proper authentication checks for something they consider a local service vulnerabilities like this will keep appearing.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#6> Does it fix the issues? Yes.
> Do I think there are other security issues here and we can bypass this? Also, yes.
> Do I want to spend more time doing free work for a company with a 2.5 TRILLION market cap? Hell, no.
Troubling.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#7I'd have taken a trip down to Buenos Aires and sold it.
While most of me likes the idea of being paid good money for my efforts, or even for doing nothing if I can get away with it, a rather pesky part of me (a nagging entity that calls itself “a conscience”) would take all the fun out of doing it by enabling harm to others (via selling information on possible exploits, for instance).
The other blockers of course being that I have neither the skills nor the time to find such flaws in the first place!
It is true that there are people out there who do have the skills, and the time, and would be fine with selling their results to third parties, so maintainers (particularly those publishing widely used projects), would do well to treat people who practise safe disclosure with sufficient inducement to keep doing so.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#8Could someone with insight give an estimate for how much you could sell an exploit like this, which let's you RCE a fair bunch of developer machines? It feels that paired with a good blog (ironically about WLS) this could be very profitable, compared to the $0 MS awarded them.
Just say "supply chain attacks" and the price can reach millions.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#9Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…
Also, using browser as UI should not mean downloading JS ever.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#10Could someone with insight give an estimate for how much you could sell an exploit like this, which let's you RCE a fair bunch of developer machines? It feels that paired with a good blog (ironically about WLS) this could be very profitable, compared to the $0 MS awarded them.
Your feeling is correct, although as other comments have mentioned it depends greatly on how you market it and to whom. Probably well above $5-10k though.
Bug bounty is good in some respects, but the people who profit the most from it are the companies and platforms. IMO it feels dirty to exploit people’s good intentions and ethics (reporting vs selling) for profits, but that’s corporations for you.