Arbitrary code execution when opening a malicious workspace
HighCVE-2019-16765 · Published Nov 22, 2019 · updated Nov 25, 2019
### Impact If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. ### Patches This is fixed in version 1.0.1 of the extension by https://github.com/github/vscode-codeql/pull/174. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the `codeQL.cli.executablePath` setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found [here](https://code.visualstudio.com/docs/getstarted/settings). ### Workarounds Manually review the workspace settings for any workspace obtained from an external source. These settings can be found in the `.vscode/settings.json` file within the workspace directory. Remove the configuration values for the `codeQL.cli.executablePath`, `codeQL.cli.owner`, and `codeQL.cli.repository` settings for the workspace. If you wish to use the `codeQL.cli.executablePath` setting to indicate the location of a CodeQL CLI executable, then move this to your user settings...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode-codeql Product | < 1.0.1 | 1.0.1 |
Details and references
### Impact If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. ### Patches This is fixed in version 1.0.1 of the extension by https://github.com/github/vscode-codeql/pull/174. Users should upgrade to this version using Visual Studio Code Marketplace's upgrade mechanism. After upgrading, the `codeQL.cli.executablePath` setting can only be set in the per-user settings, and not in the per-workspace settings. More information about VS Code settings can be found [here](https://code.visualstudio.com/docs/getstarted/settings). ### Workarounds Manually review the workspace settings for any workspace obtained from an external source. These settings can be found in the `.vscode/settings.json` file within the workspace directory. Remove the configuration values for the `codeQL.cli.executablePath`, `codeQL.cli.owner`, and `codeQL.cli.repository` settings for the workspace. If you wish to use the `codeQL.cli.executablePath` setting to indicate the location of a CodeQL CLI executable, then move this to your user settings, and check that you trust the configured path. You can access the user settings by choosing `Preferences: Open User Settings` from the Command Palette. ### References - https://code.visualstudio.com/docs/getstarted/settings ### For more information If you have any questions or comments about this advisory, open an issue in [github/vscode-codeql](https://github.com/github/vscode-codeql).
- Severity from
- GitHub (reviewed advisory)
More GitHub advisories
All GitHub| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 242025 | GitHub PAT written to debug artifacts | High | 3.28.3+1 more |
| Jul 252024 | Arbitrary File Overwrite in CodeQL versions less than 2.18.1 | High | 2.18.1 |
| Feb 222024 | Limited data exfiltration in CodeQL CLI | Low2.7 | 2.16.3 |
| May 252021 | ### Impact The CodeQL runner tool | Medium4.4 | codeql-bundle-20210304 |
| Jan 222020 | Limited header injection when using dynamic overrides with user input | Medium | ~3.9 |
| Jan 222020 | Directive injection when using dynamic overrides with user input | Medium | ~3.8 |