Attacking VSCode Extension from Browser? - Live Security Research
Source: YouTube · LiveUnderflow · published Mar 11, 2023 · 3:05:07
BLUF: The video documents a security research attempt to exploit the VS Code Language Server Protocol by sending malicious JSON-RPC messages from a browser via TCP sockets, ultimately failing due to protocol initialization requirements and browser limitations 2:15.
Key Takeaways:
• Security research involves analyzing potential vulnerabilities in libraries like the VS Code Language Server Protocol, focusing on how untrusted input might be processed 0:17.
• The Language Server Protocol enables editors to communicate with external language servers for features like autocomplete and diagnostics, typically using JSON-RPC over various transports 12:25.
• The researcher set up a basic language server example to understand the client-server communication architecture and identify potential attack surfaces 4:55.
• Analysis of the JSON-RPC implementation revealed that it parses HTTP-style headers, allowing for potential request smuggling if content length is manipulated 15:45.
• Attempts to send malicious JSON-RPC messages from a browser failed because the server requires a specific initialization handshake before accepting other messages 23:30.
• Browser-based attacks were hindered by the inability to perform HTTP pipelining or control raw TCP connections effectively from web contexts 33:50.
The investigation concluded that while the transport layer offers interesting theoretical attack vectors, practical exploitation is significantly mitigated by protocol design and browser security models. This process highlights the value of documenting failed research to help others understand complex system interactions.
Sources:
- 0:17 Definition of security research and looking for potential vulnerabilities.
- 12:25 Explanation of Language Server Protocol and its benefits.
- 4:55 Setting up a basic language server example for testing.
- 15:45 Discovery of JSON-RPC header parsing behavior.
- 23:30 Testing malicious messages and encountering initialization requirements.
- 33:50 Conclusion on the feasibility of browser-based attacks.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 2 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I asked jet GPT for a definition of what security research is so I try to add with my own words a little bit compared to like actually trying to find vulnerabilities in security research you are not necessarily looking for security issues because you're maybe looking just for potential security vulnerabilities I think this applies a lot to Frameworks and libraries because you don't know how somebody will use the library for example a library that allows to spawn processes can be implemented correctly and it will be fine or incorrectly and you have remote code execution so in this case I want to have a look at the vs code language server implementation specifically in the Json RPC protocol I noticed there's something during a client review and I thought it would be fun to further investigat…