Skip to content

Arbitrary code execution when opening a malicious workspace

High
adityasharad published GHSA-wf4x-8mpj-r42q Nov 22, 2019

Package

No package listed

Affected versions

< 1.0.1

Patched versions

1.0.1

Description

Impact

If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf.

Patches

This is fixed in version 1.0.1 of the extension by #174. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism.

After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here.

Workarounds

Manually review the workspace settings for any workspace obtained from an external source. These settings can be found in the .vscode/settings.json file within the workspace directory. Remove the configuration values for the codeQL.cli.executablePath, codeQL.cli.owner, and codeQL.cli.repository settings for the workspace.

If you wish to use the codeQL.cli.executablePath setting to indicate the location of a CodeQL CLI executable, then move this to your user settings, and check that you trust the configured path. You can access the user settings by choosing Preferences: Open User Settings from the Command Palette.

References

For more information

If you have any questions or comments about this advisory, open an issue in github/vscode-codeql.

Severity

High

CVE ID

CVE-2019-16765

Weaknesses

No CWEs