Elevation of Privilege Vulnerability

[justschen]

VS Code - Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in VS Code 1.87.1 and earlier versions for users of the code serve-web command. An attacker who has access to view process information from a lower-privilege account on a machine can inspect a connection token used to secure code server-web being run in an elevated process, and potentially access the server over the network.

Patches

The fix is available starting with VS Code 1.87.2. The fix (778a5ed) mitigates this attack by transmitting the connection token in an appropriately-permissioned file rather than as part of the process arguments.

Workarounds

Do not run code serve-web as an elevated user on a machine where untrusted users can view process information.

References

• The patch for this can be found at 778a5ed with the version bump on 863d258
• An advisory can be found at GHSA-54p6-6j68-j5vr
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26165