13 ms·
VSCode remote code execution advisory
- noizejoy 4y ago> Timeline > Date reported: 8/24/2022 > Date fixed: 10/11/2022 > Date disclosed: 11/22/2022
- david_allison 4y agoFixed >= 1.73.0 Unsure if it was backported.
- tonny747 4y agoYeah that confused me as well, the affected versions don't line up with the patched version either. I think it was fixed in 1.71.1 as per https://github.com/microsoft/vscode/security/advisories/GHSA-q6rv-h25q-6pj6 https://github.com/microsoft/vscode/security/advisories/GHSA...
- Gigachad 4y agoWeird that Google posted the dates in that format rather than something more universal
- sbierwagen 4y agoIt's an American company, so they used the American date format. Only the middle date is ambiguous anyway.
- Gigachad 4y agoGoogle is a global company and this is a message targeting VS code users who are global as well.
- daemoens 4y agoGood luck getting people to change the way they write dates, no matter how terrible it is.
- runlevel1 4y agoISO 8601 is pretty common amongst the engineers I've worked with. Odds are they didn't grow up with it unless they're from China or a handful of other countries that primarily use YYYYMMDD.
- weberer 4y agoIf you give people a good reason, they'll actually care. "Use YYYY-MM-DD as it allows us to sort by date in the filesystem" is a great reason. On the other hand, bickering about DD-MM-YYYY vs MM-DD-YYYY because "that's how it is in my country" just makes me roll my eyes.
- cowmoo728 4y agoI work at google and frequently collaborate with people from Germany, Australia, Japan, Taiwan, and the US. I always use YYYY-MM-DD in docs and emails to make sure everyone understands. It's still somewhat common to see mixups between the Americans and everyone else around MM/DD and DD/MM though.
- nonethewiser 4y ago
- chadlavi 4y agoI work at an American company and we use a reasonable date format in technical writing anyway. It's not really an excuse.
- gregmac 4y ago"This date format works for almost 61% of the year" isn't a great selling point.
- dangond 4y agoThis date format works for just as much of the year as DD/MM/YYYY though, and is just as ambiguous as the other format is if you don't know who the author is.
- 3np 4y agoSure. Which is why a non-ambiguous format would be preferred, like the ISO standard YYYY-MM-DD.
- thewataccount 4y agoWhich is also nice and sortable
- andreareina 4y agoWhich is why if I have to write a date in non-big-endian order I try to spell the month out, e.g. 07 Dec 2022
- sebazzz 4y agoThe DD-MM-YYYY format is often used with dashes instead of slashes.
- paulmooreparks 4y agoI work with lots of geographically dispersed and culturally diverse teams. The rule I always enforce is to spell (or abbreviate) the month in all dates. The other numbers tend to work themselves out.
- woodruffw 4y agoIt's a free-form text field; there's a very good chance it was an absentminded choice (it's probably how I'd write it, as an American, if I wasn't thinking too hard). The good news is that GitHub Advisories are publicly editable, so you can always suggest an update to this one.
- TillE 4y agoI'm always a little surprised when computery people don't naturally default to YYYY-MM-DD (except when you're filling out paper forms or something). It's unambiguous and always sorts correctly, and doesn't contain any awkward characters. Objectively the best date format.
- macintux 4y agoI was very annoyed when I worked for a global company that used DD-Mon-YYYY, like 01-Apr-2020. Moaned and groaned about how they chose a non-standard format instead of an ISO standard. Of course, I later found out that is a standard format, and I suppose it's easier on non-technical people even if it stinks as a computer guy. Egg on my face.
- bee_rider 4y agoIt is sort of weird that dates aren’t universally parsed user-side according to localization settings, here in year 2768.
- ipaddr 4y agoCompletely agree. yyyy-mm-dd works for sorting, reading and superseeding existing formats.
- skee8383 4y agomonth/day/year makes sense. the way you euro's do it is stupid. when someone asks you "where were you on X date" do you respond with: "Well on the 23rd day of november i was at X place"? LMAO. stop occupying the same universe as me.
- katbyte 4y agoi'll bite - why do you need to write the date the same you say it? two totally different contexts. And it leads to confusion: 11/11/2022 <- what date is that? or how about 02/05/2022? 2022-11-11 is not ambiguous. and then there is sorting. if you have filenames that are in YYYY-MM-DD you get perfect sorting by date. MM/DD/YYYY you do not. and its not just "euros" who do it that way - its basically the entire world outside of the USA.
- yakubin 4y agoI’d drop the “day”, but yes.
- EugeneOZ 4y ago8 billion - USA population = how many people you insulted.
- dang 4y agoHey, could you please stop breaking the site guidelines, such as by calling names ("stupid"), or posting unsubstantive or flamebait comments? You've been doing this repeatedly, and we eventually have to ban such accounts. It's not what this site is for, and destroys what it is for. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
- skee8383 4y ago"Conflict is essential to human life, whether between different aspects of oneself, between oneself and the environment, between different individuals or between different groups. It follows that the aim of healthy living is not the direct elimination of conflict, which is possible only by forcible suppression of one or other of its antagonistic components, but the toleration of it—the capacity to bear the tensions of doubt and of unsatisfied need and the willingness to hold judgement in suspense until finer and finer solutions can be discovered which integrate more and more the claims of both sides. It is the psychologist's job to make possible the acceptance of such an idea so that the richness of the varieties of experience, whether within the unit of the single personality or in the wider unit of the group, can come to expression."
- poorgigachad 4y agoSaid the bitter, envious europoor "I'd never want to live in America. I'd much rather make a quarter as much money and live in a cramped pitiful excuse for a home. Free health care!"
- dang 4y agoCan you please not create accounts to break the site guidelines? Doing that will eventually get your main account banned as well. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- oefrha 4y agoTangential: Google search date range only accepts MM/DD/YYYY even if you’re on a different version of Google with a different locale. Really lazy if you ask me. Must be confusing to a lot of people, too.
- fomine3 4y agoThis is really frustrating. Its format is not indicated on the form so my natural (in ja-jp) YYYY/MM/DD input interpret as weird date. I never use MM/DD/YYYY format other than this. This is localization 101 problem on big tech's main product.
- jwilk 4y agoFixed timeline: > Date reported: 2022-08-24 > Date fixed: 2022-10-11 > Date disclosed: 2022-11-22
- spatley 4y agohttps://xkcd.com/1179/ https://xkcd.com/1179/
- nhinck2 4y ago> Jypiter I feel someone's pain here. "You've spelt Jupiter incorrectly, it should have a y"
- uwuemu 4y agoLets be honest here: The name is FUCKING IDIOTIC. Every time I write "jupwhatever notebook" I want to ... break things.
- cauthon 4y agoalias nb=“jupyter notebook”
- k_sze 4y agoI find it relatively easy to remember, while also helping narrow down search results from most search engines.
- culi 4y agoright, I kinda wish more languages did things like this. Every JS framework or library has a cute name but then realizes they need to always say the ".js" if they ever want any SEO results (looking at you Next. Node isn't much better either tho). It might be silly, but if we just added some l33tspeak like n3xt or n0d3 we would actually be making out lives a lot easier. Or we could just spend like a whole extra minute to come up with something like Deno which is short and sweet and apparently unique enough to never conflict with other results
- zharknado 4y agoMy charitable reading is that “y” roughly corresponds to “oo” in some languages, so there’s a world in which this spelling makes sense. But yeah it’s Jupyter. Like Jupiter but for Python.
- mmdski 4y agoEdit: Somehow they get Jupyter from Julia, Python, R
- hn_throwaway_99 4y agoRelated question about this, with apologies if this is a dumb question. For small to mid size tech companies (say small startups to 1000 employees), what are the general recommended IT procedures to ensure application software like this is updated across the company? That is, every company I've worked at has had some form of device management software on their laptops, but that software only ensured that the OS and some specific "managed applications" were always patched. For developers, though, we never had fully "locked down" machines because they made our job so much more difficult (that is, more than other departments we'd often be installing and running new software). In that case, are there some specific corporate controls to ensure nobody is running an unpatched VSCode, beyond messaging all engineers and saying "you better make sure your VSCode installation is updated, or else..."?
- sllewe 4y agoFor Windows deployments - Microsoft Intune provides the ability to monitor any application and its version. Updating is automatic provided its installed correctly and using detection rules. The responsible party updates the MSI installation files and the local management service will perform the update.
- EvanAnderson 4y agoYeah, but who uses MSIs? Windows Installer is just a flash in the pan. It's so much easier to just make an Inno Setup-based SETUP.EXE. /s It makes me shudder to think how many hours (days? weeks?) of my life I'd have back if developers had just packaged their Windows application as MSIs instead of making me, as a sysadmin who wants consistently updated client computers, do it for them.
- vbezhenar 4y agovscode does not provide MSI for download. Even Microsoft can't be bothered to do it.
- EvanAnderson 4y ago
- bmitc 4y agoAdvisory makes it sound like this is an active security flaw. However, it was fixed almost two months ago.
- void-star 4y agoThis is pretty standard, timeline-wise, for most responsible disclosure policies. As-in : Give the vendor ample time to publish and deploy a fix before reporting vulnerability specifics. Aside: As usual, excellent work from Google project-zero
- infamouscow 4y agoPrediction: VSCode extensions to mine crypto on dev laptops in 2023.
- theobr 4y agoThe origin story of how zemnmez found this is so hilarious > i got tricked into finding some 0days in vscode because I got asked to review a vscode based project and didn't notice the 1P devs had only made one minor change to it. actually not a joke https://twitter.com/zemnmez/status/1562103677686407168 https://twitter.com/zemnmez/status/1562103677686407168
- paraph1n 4y agoCan someone explain? I can barely parse this quote. Who are the 1P devs? Why does it matter that they didn't notice they had made a minor change? Why were they "tricked"? Edit: I think I might understand it more now: This person got tricked into carefully reviewing the "entire" code, instead of focusing on the one minor change that was made to it, because they didn't realize it was only the minor change they had to review. In their careful review of the code, they uncovered vulnerabilities which were actually related to the original code (ie. VSCode) rather than the changes that this person was asked to review. Did I get it? I'm still confused about the use of "1P" here though.
- dankwizard 4y agoI assume 1Password
- zemnmez 4y agoFirst-party (i.e. Google). Tricked in the sense I was asked to do a security assessment and didn't check what differential changes had been made edit: correct!
- sitkack 4y agoI found a linked list bug in FreeBSD because I am less smart than my buddy who was like it's trivial bla bla bla. I am like wait, lets back up, I don't understand this... I think one sniff out shifty code, as soon as you open the file you can tell there are going to be bugs in there. I am not saying, well groomed high level code is high quality or bug free. A couple trivial deficiencies and there a probably a whole lot more you don't see. Like if the code has a low to zero number of tests. Or the build system includes top level shell commands.
- coding123 4y agoWe're all patched in case anyone is wondering.
- jwilk 4y agoWe?
- larsnystrom 4y agoHey guys, I found the outsider!
- gravypod 4y agoThe contents of the ‘file’ in this code are a single Markdown cell in ipynb format. Because Markdown allows arbitrary HTML, in trusted mode, we can inject any HTML code we want into the webview. This is a very common foot-gun with markdown. Unfortunate that they did not sanitize the HTML output from their renderer.
- zemnmez 4y agoThe logic here is somewhat sound. VSCode does sanitize by default, but Jupyter notebooks effectively need to run Python code on your machine to work. At that point (this is the meaning of trusted mode), it's not really worth protecting yourself against XSS.
- p-e-w 4y ago> Date reported: 8/24/2022 > Date fixed: 10/11/2022 ONE AND A HALF MONTHS to fix this? Am I reading this right?!? This should have been a same-week emergency patch. > Date disclosed: 11/22/2022 So anyone who didn't update VSCode during those 6 weeks is vulnerable to a publicly documented RCE. Lovely. It's nothing short of insane that we have to treat our text editor as a high-risk potential backdoor that might suddenly open to anyone unless we click the "Check for Updates" button every few hours.
- booi 4y agoSaying Vscode is a text editor is like saying Autocad is a piece of virtual paper. Not exactly a fair assessment. I’m actually surprised there haven’t been more significant issues
- theteapot 4y agoThat we know about. Last I checked VSCode extensions run completely unsandboxed, at least on Linux. It's only a matter of time before a malicious one is discovered.
- jbverschoor 4y agoWIth the current state of software it makes most sense to have each project live in a container / vm. Including all dependencies, and visual code. Unfortunately using visualcode server isn't safe enough either. Something like qubes seems to be the future.. or present if you're running it :-)
- deleted 4y ago[deleted]
- wunderwuzzi23 4y agoSomewhat related because also a VSCode/Jupyter and script execution issue, I found CVE-2020-16977 two years back and it was also treated as RCE. Write up: https://embracethered.com/blog/posts/2020/cve-2020-16977-vscode-microsoft-python-extension-remote-code-execution/ https://embracethered.com/blog/posts/2020/cve-2020-16977-vsc... Microsoft's bulletin: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-16977 https://msrc.microsoft.com/update-guide/en-US/vulnerability/...
- hulitu 4y ago> VSCode remote code execution advisory Why would an IDE execute remote code ? /s
- macrolime 4y agoI think the takeaway here is that there's likely more of these kind of vulnerabilities that's not discovered and VSCode should run in a sandbox or separate virtual machine.
- POPOSYS 4y agoLike for any other piece of complex software!
- kubanczyk 4y ago> and VSCode should run in a sandbox or separate virtual machine No, because VSCode is used for producing new software. 1. Any newly written code would need additional vetting to permit it to run outside the original sandbox. 2. Industrial espionage. In particular, the attacker would immediately see any vulnerability in the making.
- brainyz 4y agoit did require to have the Remote Development Extension Pack installed right? or was the vulnerability discovered in the core VS Code?
- rs_rs_rs_rs_rs 4y agoThis is a core VS Code vulnerability, the remote development extension is mentioned because this vulnerability can be used to "take over the computer of a Visual Studio Code user and any computers they were connected to" using the remote development extension.
- vscodeuser 4y agoWould running vscode in docker/podman mitigate the risk? When I started using VSCode I was a bit worried about potentially unwanted network traffic originating from VSCode and for that reason I'm executing it from podman container without routing to the internet.
- dijit 4y agoDocker and Podman are not security countermeasures. They appear as such accidentally through controlling resources and visibility of the filesystem. Docker and Podman solve the "isolated environment for development so I can control my dependencies", "package management" and "reproducible environment" problems; which is already a lot. We should not pretend that it's doing more than it is; since it is already covering many important topics and it muddies the conversation. The reason I'm being so detailed is that there are a contingent of people who will swear to death that Docker is a security layer: but notably none of them are ever security engineers.
- vscodeuser 4y agoI agree with original intent behind docker. But is the idea of unix namespaces not serving wider purpose than what docker/podman is delivering..? If process in question is contained within namespace then would it not be enough to stop the exploit of process in question from doing harm to your system? I assume the bad actor would not combine such exploit with, say, kernel exploit enabling to escape unix namespace.
- kevinsundar 4y agoWell containers use security features in the kernel by definition in their implementations. It’s pretty easy to make an argument that containers are a security layer especially in their default state. When you start adding capabilities and patching through the docker socket then things get insecure real quick.
- dijit 4y agoYou can use similar primitives that docker is using to achieve security hardening. Even docker themselves have a detailed dossier of documents saying they’re not a security layer (but that they’d like to be). From FAQ: > Is Docker a secure platform? > The Docker platform itself isn’t inherently secure or insecure. While containers may be isolated from other processes on a host, additional security measures are still crucial to prevent container breakout and other types of vulnerabilities. An effective container security strategy for building and deploying containers is the best way to reduce the risk of a vulnerability, and in turn, an attack. Just like any other technology platform, following security best practices is the key to mitigating potential threats.