News for hackers. Stuff that matters.

A comment on RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit.

Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by gigel82 on Tuesday December 21, 2021 @08:51AM (#29637339)
If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999% of cases; who just exposes their development machine directly to the internet with a public IP?

Still bad, but not quite as bad as owning from the browser via localhost GET.

[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by ectopod on Tuesday December 21, 2021 @09:27AM (#29637632)
No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.
[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by dboreham on Tuesday December 21, 2021 @10:21AM (#29638184)
Wait, the browser allows random http connections to localhost from JS fetched from any domain??

Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.

[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by AntonyGarand on Tuesday December 21, 2021 @12:37PM (#29639825)
It does, if the server accepts the connection there is nothing preventing it.

This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports.

[0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by nitrogen on Tuesday December 21, 2021 @12:08PM (#29639435)
Do browsers block access to 192.168/16 or 10/8 etc?
[ Parent | on HN ]
Re:RCE in Visual Studio Code's Remote WSL for Fun and Negati... by fulafel on Tuesday December 21, 2021 @01:16PM (#29640297)
This guess would be incorrect both in the percentage, and in the assumption that this would be required for exploitability.
[ Parent | on HN ]