1-Click GitHub Token Stealing via a VSCode Bug

Security researcher Ammar Askar unveiled a critical 1-click vulnerability in github.dev, the browser-based version of VSCode. This exploit allows an attacker to steal a user's GitHub token, granting full read/write access to all their public and private repositories, simply by clicking a malicious link.

• The github.dev editor, accessed by changing github.com to github.dev in a repo URL, provides a full-featured VSCode experience in the browser. Crucially, it receives a broadly-scoped OAuth token from github.com that grants access to all user repositories.
• VSCode webviews, used for rendering content like Markdown or Jupyter notebooks, are typically isolated in cross-origin iframes, communicating with the main application via Window.postMessage().
• The core vulnerability lies in how VSCode handles keyboard events: webviews are allowed to bubble up keydown events to the main VSCode window, ensuring basic functionality like command palette (Ctrl+Shift+P) works inside them.
• The exploit chain abuses this: attacker-controlled JavaScript in a webview (e.g., from a Jupyter notebook) simulates keystrokes.
  • First, it triggers Ctrl+Shift+A to accept a notification prompting installation of a "recommended" local workspace extension.
  • Local workspace extensions are exempt from new publisher trust checks in trusted workspaces (which github.dev is).
  • While Content Security Policy (CSP) prevents running JavaScript directly from a local extension in the web version, its package.json can still contribute custom keybindings.
  • A custom keybinding (e.g., Ctrl+F1) is then defined in the local extension's package.json to call the workbench.extensions.installExtension command with skipPublisherTrust: true, thereby installing the actual malicious extension from the marketplace.
• The proof-of-concept demonstrates this by installing an extension that fetches and displays the user's GitHub token and private repository list.
• Self-protection involves clearing github.dev site data to force re-authentication, allowing users to decline token provisioning. Once provisioned, no further dialogs protect the user.
• The author notes that VSCode's good security practices like strict CSP and DOMPurify still prevent many easier XSS exploits.
• The full public disclosure was a deliberate choice due to past negative experiences with Microsoft Security Response Center (MSRC), where previous bugs were allegedly silently fixed without credit or recognition of severity.

This exploit highlights the subtle complexities of security in modern web applications, where multiple seemingly minor features can be chained into a critical vulnerability. It also brings to light the ethical challenges faced by security researchers dealing with corporate security response teams.