Microsoft Visual Studio Code Environment Variable privileges management

Summaryinfo

A vulnerability was found in Microsoft Visual Studio Code. It has been rated as critical. This affects an unknown function of the component Environment Variable Handler. This manipulation causes privileges management. This vulnerability is tracked as CVE-2020-0604. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in Microsoft Visual Studio Code (Programming Tool Software) (version unknown). Affected by this vulnerability is an unknown function of the component Environment Variable Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opened the integrated terminal. The update address the vulnerability by modifying the way Visual Studio Code handles environment variables.

The weakness was disclosed 08/11/2020 as confirmed security update guide (Website). It is possible to read the advisory at portal.msrc.microsoft.com. The public release has been coordinated in cooperation with Microsoft. This vulnerability is known as CVE-2020-0604. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. The advisory points out:

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Tool Software

Vendor

• Microsoft

Name

• Visual Studio Code

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion