github.dev vulnerability can give attackers access to private repositories

A publicly disclosed vulnerability in the browser-based version of Visual Studio Code on github.dev can allow an attacker to steal a user's GitHub authentication token if the user opens a specially crafted repository link. The token provides read and write access to the repositories the user can reach, including private ones. The issue stems from VS Code webviews forwarding keyboard events to the main workbench, and the published proof of concept uses this to install an attacker-controlled extension. Microsoft has acknowledged the report, says a fix is being prepared, and states that VS Code Desktop is not affected.

What this means for your organisation

Developer tokens are effectively keys to your source code. An attacker holding a token with write access can both read business-critical code and introduce changes that flow onward into the build chain. With a proof of concept already published, the barrier for other actors to adopt the technique is low while a fix is pending. For any organisation doing its own development, this is a supply chain control question, not merely a developer inconvenience.

Berigo recommends

• Consider blocking access to github.dev until Microsoft has remediated the issue.
• Ask users who have used github.dev to clear cookies and local site data for the domain.
• Review what access developer tokens actually hold and reduce it to what is required.
• Monitor repositories for unexpected changes and for new extensions or integrations.

Source

• blog.ammaraskar.com
• github.com