sourcegraph cody .vscode/cody.json external control of setting

Summaryinfo

A vulnerability has been found in sourcegraph cody and classified as critical. This vulnerability affects unknown code of the file .vscode/cody.json. This manipulation causes external control of setting. This vulnerability appears as CVE-2023-46248. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in sourcegraph cody (the affected version unknown) and classified as critical. Affected by this vulnerability is an unknown part of the file .vscode/cody.json. The manipulation with an unknown input leads to a external control of setting vulnerability. The CWE definition for the vulnerability is CWE-15. One or more system settings or configuration elements can be externally controlled by a user. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file `.vscode/cody.json` and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user's machine. The vulnerability is rated as critical severity, but with low exploitability. It requires the user to have a malicious repository loaded and execute the overwritten command in VS Code. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. The issue was found during a regular 3rd party penetration test. The maintainers of Cody do not have evidence of open source repositories having malicious `.vscode/cody.json` files to exploit this vulnerability. The issue is fixed in version 0.14.1 of the Cody VSCode extension. In case users can't promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded.

The weakness was presented 10/31/2023 as GHSA-8wmq-fwv7-xmwq. The advisory is shared at github.com. This vulnerability is known as CVE-2023-46248 since 10/19/2023. Technical details are known, but no exploit is available.

By approaching the search of inurl:.vscode/cody.json it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• sourcegraph

Name

• cody

Website

• Product: https://github.com/sourcegraph/cody/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion