VSCode Python Extension Code Execution

vendor:

Visual Studio Code

by:

Doyensec

7.5

CVSS

HIGH

Code Execution

CWE

Product Name: Visual Studio Code

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE: a:microsoft:visual_studio_code

Metasploit:

Other Scripts:

Platforms Tested: macOS

2020

VSCode Python Extension Code Execution

VScode may use code from a virtualenv found in the project folders without asking the user, leading to arbitrary code execution by cloning and opening a malicious Python repository.

Mitigation:

Update to the latest version of the Visual Studio Code Python extension.

Source

Exploit-DB raw data:

# VSCode Python Extension Code Execution

This repository contains the Proof-of-Concept of a code execution vulnerability discovered in the [Visual Studio Code](https://code.visualstudio.com/) Python extension.

>TL;DR: VScode may use code from a virtualenv found in the project folders without asking the user, for things such as formatting, autocompletion, etc. This insecure design leads to arbitrary code execution by simply cloning and opening a malicious Python repository.

You can read more about this vulnerability on our blog: [https://blog.doyensec.com/2020/03/16/vscode_codeexec.html](https://blog.doyensec.com/2020/03/16/vscode_codeexec.html).

## HowTo

- Clone the 'malicious' repository with `git clone https://github.com/doyensec/VSCode_PoC_Oct2019.git`
- Add the cloned repo to a VSCode workspace on macOS. Note that the vulnerability affects all platforms, but the PoC is executing *Calculator.app*
- Open `test.py` in VScode


Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48231.zip