Elevation of Privilege Vulnerability
HighCVE-2022-38020 · Published Sep 14, 2022
An elevation of privilege vulnerability exists in VS Code v1.71.0 and earlier versions where on a shared Windows machine, a low-privileged user can create a `bash.exe` executable in a location where terminal profiles are detected. This detected profile is then exposed in the terminal profiles list and can be run easily by a higher-privileged user on the same machine. The paths in question were: * `C:\Cygwin64\bin\bash.exe` * `C:\Cygwin\bin\bash.exe` * `C:\ProgramData\scoop\apps\git-with-openssh\current\bin\bash.exe` ### Patches The fix is available starting with **VS Code 1.71.1**. The fix (https://github.com/microsoft/vscode/commit/0b356bf51acf15749e0e22d28fb803d7171e975e) mitigates this attack by removing those paths completely from the terminal profile detection feature. ### Workarounds Avoid running terminal profiles that are not expected to be installed on the machine. An administrator may be able to lock down the folders in question. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/0b356bf51acf15749e0e22d28fb803d7171e975e * An issue for this can be found at https://github.com/microsoft/vscode/issues/160827 * MSRC details for...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.71.1 | 1.71.1 |
Details and references
An elevation of privilege vulnerability exists in VS Code v1.71.0 and earlier versions where on a shared Windows machine, a low-privileged user can create a `bash.exe` executable in a location where terminal profiles are detected. This detected profile is then exposed in the terminal profiles list and can be run easily by a higher-privileged user on the same machine. The paths in question were: * `C:\Cygwin64\bin\bash.exe` * `C:\Cygwin\bin\bash.exe` * `C:\ProgramData\scoop\apps\git-with-openssh\current\bin\bash.exe` ### Patches The fix is available starting with **VS Code 1.71.1**. The fix (https://github.com/microsoft/vscode/commit/0b356bf51acf15749e0e22d28fb803d7171e975e) mitigates this attack by removing those paths completely from the terminal profile detection feature. ### Workarounds Avoid running terminal profiles that are not expected to be installed on the machine. An administrator may be able to lock down the folders in question. ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/0b356bf51acf15749e0e22d28fb803d7171e975e * An issue for this can be found at https://github.com/microsoft/vscode/issues/160827 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38020
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Oct 112022 | Information Disclosure Vulnerability | Medium | 1.71.1 |
| Oct 112022 | Remote Code Execution Vulnerability | High | 1.71.1 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.64.1 |
| May 252022 | Spoofing Vulnerability | High | 1.65.1 |
| May 252022 | Elevation of Privilege Vulnerability | High | 1.66.2 |
| May 252022 | Remote Code Execution Vulnerability | High | 1.67.1 |