module
VSCode ipynb Remote Development RCE
| Disclosed |
|---|
| Nov 22, 2022 |
Disclosed
Nov 22, 2022
Description
VSCode when opening an Jupyter notebook (.ipynb) file bypasses the trust model.
On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed
HTML and javascript, which can then open new terminal windows within VSCode.
Each of these new windows can then execute arbitrary code at startup.
During testing, the first open of the Jupyter notebook resulted in pop-ups
displaying errors of unable to find the payload exe file. The second attempt
at opening the Jupyter notebook would result in successful exeuction.
Successfully tested against VSCode 1.70.2 on Windows 10.
On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed
HTML and javascript, which can then open new terminal windows within VSCode.
Each of these new windows can then execute arbitrary code at startup.
During testing, the first open of the Jupyter notebook resulted in pop-ups
displaying errors of unable to find the payload exe file. The second attempt
at opening the Jupyter notebook would result in successful exeuction.
Successfully tested against VSCode 1.70.2 on Windows 10.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.