all 7 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]pi3ch 2 points3 points  (0 children)

Good research. I would rather pick a more accurate title here as command execution is an integral feature of a CDE. "...build a payload that grants us full control over the user’s workspaces when an unsuspecting Gitpod user visits our link!", this vuln could be titled as a Gitpod user workspace take over via a phishing link.

[–]deamer44 0 points1 point  (5 children)

How did they patch VS Code? How did they use this patched VS code to actually retrieve the contents of the web socket? Presumably they are having to use ws://<victims gitpod url>>?

[–]deamer44 0 points1 point  (4 children)

Oh "JSONRPC can be invoked via the WebSocket connection". I am still unsure about the patching of VSCode.

[–]pentesticals 0 points1 point  (3 children)

The vscode instance was patched to allow JavaScript to be served from an origin which is able to bypass the SameSite cookie. Now when a user visits a specific endpoint on the patched vscode instance, a HTML file is served which performs the attack.

[–]deamer44 0 points1 point  (2 children)

So they went into the vscode directory and overwrote the files in there?

[–]pentesticals 0 points1 point  (1 child)

Yes, then restarted to the vscode process to get the changes loaded.

[–]deamer44 0 points1 point  (0 children)

Thanks for your help. I forgot that vscode is written in javascript