PT-2023-29927 · Microsoft · Vscode

Andreeleuterio · Published 2023-10-31 · Updated 2023-11-08 · CVE-2023-46248

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cody AI VSCode extension versions 0.10.0 through 0.14.0

Description The issue concerns Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user's machine. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. It was found during a regular 3rd party penetration test. The maintainers do not have evidence of open source repositories having malicious .vscode/cody.json files to exploit this issue.

Recommendations For Cody AI VSCode extension versions 0.10.0 through 0.14.0, upgrade to version 0.14.1 to fix the issue. In case users can't promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded.

Exploit

Fix

Weakness Enumeration

CWE-15

Related Identifiers

CVE-2023-46248

GHSA-8WMQ-FWV7-XMWQ

Affected Products

Vscode

References · 7

• 🔥 https://github.com/sourcegraph/cody/pull/1414 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46248.json · Exploit
• https://github.com/sourcegraph/cody/security/advisories/GHSA-8wmq-fwv7-xmwq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46248 · Security Note
• https://twitter.com/VulmonFeeds/status/1719422886698426681 · Twitter Post
• https://t.me/cibsecurity/73252 · Telegram Post