vscode-codeql 1.0.1 codeQL.cli.executablePath path traversal

Summaryinfo

A vulnerability has been found in vscode-codeql 1.0.1 and classified as critical. Impacted is an unknown function of the component codeQL.cli.executablePath. The manipulation leads to path traversal. This vulnerability is documented as CVE-2019-16765. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in vscode-codeql 1.0.1. This issue affects an unknown part of the component codeQL.cli.executablePath. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the codeQL.cli.executablePath setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found here.

The weakness was released 11/25/2019 (GitHub Repository). The advisory is shared at github.com. The identification of this vulnerability is CVE-2019-16765 since 09/24/2019. An attack has to be approached locally. A simple authentication is necessary for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• vscode-codeql

Version

• 1.0.1

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion