[dead]
1-Click GitHub Token Stealing via a VSCode Bug
21–30 of 116 posts
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#22Very good write up but I lost it a little at the end. Could someone clarify for me? The author said: You cannot just use the shortcut trick to install the evil extension directly because of new publisher trust system; You can bypass this by using local workspace extensions which has no publisher screening, but CSP blocks it; The solution seems to be that installing a local workspace extension which binds a shortcut o…
1 and 2 are correct, take a look at the PoC repo here: https://github.com/ammaraskar/github-dev-token-steal-poc/tre...
We can try to just put a `my-extension/extension.js` for the most direct execution but the CSP blocks that. It's only a script-src CSP blocking it though, so fetching the package.json is still kosher. So we end up using it to contribute a keybinding instead.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#23This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…
If the malicious-npm-package-of-the-week is reading arbitrary files on your workstation, isn't it usually able to run git clone/push/whatever with your current credentials anyway?
Not if they're touch required in a secure enclave like a yubikey
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#24I had this happen to me recently
github token got stolen and also cloudflare tokens
guys even if you take security seriously you are going to get hit on a long enough time frame
best thing to do is segregate and control damage
trust no one, nothing, use orbstack, and always operate under the assumption that your token is going to get leaked at some point
it knocked off my entire momentum. fortunately seemed like it was just a spam bot that took my tokens and created bunch of fake spam pages and trying to mine crypto
the biggest feeling is the one of feeling violated
take care fellow travelers
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#25> if you had some other XSS in a webview that you can get a victim to open, you get effectively full RCE on their computer.
Github creds or the computer, can't decide which one is worse.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#26> To those folks, I am sorry, but this is one of the few levers I have to try to influence MSRC and the security posture of VSCode Someone is going to be blacklisted by Microsoft.
"Oh great Mythos, how do I remove all vulnerabilities from my products?"
Percolating...
Ban all vulnerability researchers
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#27> the last time I interacted with MSRC regarding reporting a VSCode bug, it was a horrible experience where they silently fixed the bug Classic MSRC. It has figured out that researchers will report for free regardless. Why change?
MSRC doesn’t fix bugs. I don’t know the specifics of this case, but I’ve managed bug bounty programs in the past through Bountysource and HackerOne. One thing that occasionally happens is that a report makes its way to the development team before the security team has fully assessed it, in this case MSRC. At that point, a developer may decide to quietly fix the issue. Sometimes that’s driven by a concern, rational or…
That makes sense but doesn't excuse the behavior. Just because there is poor communication within Microsoft doesn't make it okay to silently patch a vulnerability. Also, looking at the timeline on OP's post from 2023 it seems they patched it and closed the bug on the same day which is a little sus .
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#28Very unethical behavior combined by very bad security posture from the vendor. Bad.
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#29I had this happen to me recently github token got stolen and also cloudflare tokens guys even if you take security seriously you are going to get hit on a long enough time frame best thing to do is segregate and control damage trust no one, nothing, use orbstack, and always operate under the assumption that your token is going to get leaked at some point it knocked off my entire momentum. fortunately seemed like it w…
> created bunch of fake spam pages and trying to mine crypto
Re: 1-Click GitHub Token Stealing via a VSCode Bug
#30If you like VSCode but don't like Microsoft, try Zed (zed.dev).
I heard that Zed came with a lot of integrated AI and team sharing features that phone home, so that's an issue for anyone working with stuff like NIS2 compliance. Not that VSCode isn't a compliance nightmare as well.