VSCode remote code execution advisory

Re:VSCode remote code execution advisory by cosmotic on Tuesday December 06, 2022 @10:30PM (#33890336)

I suspect you could write a script that detects or locates VSCode, verifies the version, and updates as necessary, and run the script on all computers that are managed. Or at least report back version information to understand the impact.

[ Parent | on HN ]

Re:VSCode remote code execution advisory by mdeeks on Wednesday December 07, 2022 @12:04AM (#33890805)

This should work to find affected versions on macOS. I'm on Ventura and sort has the -V version sort option. Not sure if all versions of macOS do.

  verlte() {
      # Returns code 0 if first arg is less than or equal two the second arg
      [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
  }
  
  vscode_version=$(/Applications/Visual\ Studio\ Code.app/Contents/Resources/app/bin/code -v | head -n 1)
  vulnerable_version="1.71.1"
  if verlte $vscode_version $vulnerable_version; then 
      echo 'Vulnerable version!'
  else
      echo "Up to date version"
  fi

[ Parent | on HN ]

Re:VSCode remote code execution advisory by cosmotic on Wednesday December 07, 2022 @05:46PM (#33901461)

It might be worth doing a full file system scan so it catches the app in locations other than /Applications

[ Parent | on HN ]