Introduction
Imagine for a moment that a single click on a link is all it takes for an attacker to access your GitHub token, giving them the keys to your repositories, even private ones. It sounds unbelievable, but this is exactly what a bug in Visual Studio Code (VSCode) allowed. Let's explore how this was made possible and what measures can be taken to protect oneself.
Background
GitHub offers a handy feature called github.dev. It allows opening a repository directly in a lightweight version of VSCode, running entirely in your browser. To do this, GitHub sends an OAuth token to github.dev, enabling it to interact with your repositories on your behalf. The problem is, this token is not restricted to the initially visited repository, but provides full access to all repositories you have access to.
VSCode Webview Security Model
VSCode, being an Electron application, needs to protect against arbitrary JavaScript execution that could lead to remote code execution. For this, VSCode uses webviews, which are iframes with a different origin than the main VSCode window. This prevents JavaScript executed within these webviews from accessing Node.js APIs or directly interacting with the main application.
These webviews are used for features like Markdown previews or editing Jupyter notebooks. However, the complexity and interconnectivity of VSCode's code create opportunities for attackers to discover vulnerabilities.
The Vulnerability
The exploited flaw relies on a combination of poor isolation of the webview and manipulation of origin permissions. By targeting a user with a specially crafted link, an attacker can force the execution of malicious scripts in the webview's context, thereby accessing the GitHub token.
Proof of Concept and Protection
A proof of concept demonstrating this attack showed that it took just a few lines of code to exfiltrate a token. To protect yourself, it's essential to always update VSCode to its latest version, where such vulnerabilities are usually quickly patched. Additionally, closely monitor the permissions granted to webviews and avoid clicking on unverified links.
VSCode's Response
VSCode responded quickly by fixing the flaw and strengthening security measures around webviews. This highlights the importance of responsible disclosure and swift collaboration between security researchers and application developers.
Conclusion
The security of development tools is crucial, especially when they interact with environments as sensitive as GitHub. This incident serves as a reminder of the importance of staying vigilant against new threats. Let's discuss your project in 15 minutes.
References
- [Ammar Askar’s Blog on GitHub Token Stealing](https://blog.ammaraskar.com/github-token-stealing/)