1-Click GitHub Token Stealing via a VSCode Bug
blog.ammaraskar.com
1-Click GitHub Token Stealing via a VSCode Bug
1–10 of 116 posts
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#2Thank you for essentially donating the time you spent on this exploit to raise awareness on improving VS Code's security response. You could have just given up on them but you're still trying to help.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#3This is a very good writeup.
Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all. Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find.
In a perfect world, it'd be awesome if the in-browser IDE launched with a temporary per-repo permission scope or token that allowed only pull and push to the repo in question; no github.com web session whatsoever. If you want the full GitHub web UI experience, well .... go back to github.com; make github.dev a single-repo service.
I'm assuming that's a) inconvenient for users, b) hard to implement, and c) a historical assumption baked into a lot of the github.dev tooling, though. Ah well.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#4> To those folks, I am sorry, but this is one of the few levers I have to try to influence MSRC and the security posture of VSCode
Someone is going to be blacklisted by Microsoft.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#5> the last time I interacted with MSRC regarding reporting a VSCode bug, it was a horrible experience where they silently fixed the bug
Classic MSRC. It has figured out that researchers will report for free regardless. Why change?
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#6> To those folks, I am sorry, but this is one of the few levers I have to try to influence MSRC and the security posture of VSCode Someone is going to be blacklisted by Microsoft.
[flagged]
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#7This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…
If the malicious-npm-package-of-the-week is reading arbitrary files on your workstation, isn't it usually able to run git clone/push/whatever with your current credentials anyway?
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#8The MSRC situation is really unbelievable.
There are probably better sources but I think this video by The Primeagen is a good introduction.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#9If you like VSCode but don't like Microsoft, try Zed (zed.dev).
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#10This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…
> it'd be awesome if the in-browser IDE launched with a temporary per-repo permission scope
That's actually exactly what they do for codespaces. The token only has read/write on the repo you activated for the codespace [1]. They should definitely consider doing that for github.dev as well.
[1] https://orca.security/resources/blog/hacking-github-codespac...