PT-2023-9085 · Microsoft+1 · Visual Studio Code+1

Paul Gerste · Publicado 2023-06-07 · Atualizado 2024-04-25 · CVE-2023-46944

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitKraken GitLens versions prior to 14.0.0

Description The issue is related to insufficient input validation in the GitKraken GitLens plugin for Visual Studio Code, allowing an attacker to execute arbitrary code via a crafted file. This can be exploited by an attacker to gain unauthorized access and execute malicious code.

Recommendations For versions prior to 14.0.0, update to version 14.0.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Visual Studio Code workspace trust component to minimize the risk of exploitation. Avoid using crafted files that could potentially exploit the insufficient input validation in the GitKraken GitLens plugin.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2024-03537

CVE-2023-46944

Produtos afetados

Gitkraken Gitlens

Visual Studio Code

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/gitlens_local_config_exec.rb · Exploit
• 🔥 https://sonarsource.com/blog/vscode-security-markdown-vulnerabilities-in-extensions · Exploit
• https://github.com/gitkraken/vscode-gitlens/commit/ee2a0c42a92d33059a39fd15fbbd5dd3d5ab6440 · Correção
• https://osv.dev/vulnerability/CVE-2023-46944 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-03537 · Nota de Segurança
• https://t.me/cvenotify/61385 · Publicação no Telegram
• https://t.me/cvenotify/61457 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46944 · Nota de Segurança
• https://t.me/cybersecuritytechnologies/10397 · Publicação no Telegram