VS Code zero-day lets hackers steal GitHub tokens in one click
A researcher, Ammar Askar, has released exploit code for a Visual Studio Code (VS Code) zero-day vulnerability that allows attackers to steal GitHub authentication tokens by tricking users into clicking a link. The vulnerability exploits VS Code's sandboxed webview message-passing system to install malicious extensions and steal tokens, potentially granting access to a victim's GitHub repositories. The researcher chose immediate public disclosure due to past negative experiences with Microsoft's security response process.
The vulnerability, discovered by researcher Ammar Askar, allows attackers to install malicious extensions within VS Code that target github.dev, a browser-based version of the editor used for working on GitHub repositories. The exploit leverages the sandboxed webview message-passing system to execute malicious JavaScript, simulating keypresses and installing an extension designed to extract the GitHub OAuth token sent to github.dev. This token, lacking specific scoping, grants the attacker full access to all repositories the victim has access to. Users can mitigate the risk by clearing cookies and local site data for github.dev in their browser.