Drag and Pwnd: Leveraging ASCII Characters to Exploit VS Code
PortSwigger researcher Zakhar Fedotkin reveals a critical vulnerability in Visual Studio Code involving the abuse of ASCII control characters. The exploit targets node-pty, a library used by VS Code to simulate pseudo-terminals, which blindly forwards raw bytes to the shell. By injecting control characters like SOH (Start of Header) and ETX (End of Text) into configuration arguments or filenames, attackers can manipulate shell behavior. For instance, inserting SOH moves the cursor to the line's beginning, allowing malicious commands to overwrite legitimate ones. Additionally, dragging files with embedded control characters, such as ETX followed by a carriage return, can execute arbitrary commands like opening applications without user consent. This issue affects macOS and Ubuntu, where filesystems permit such characters in filenames, while Windows remains largely unaffected due to filesystem restrictions and PowerShell's handling of control codes. The research highlights how legacy communication protocols are repurposed in modern environments, creating unexpected security risks in popular development tools.
Wire timeline
Drag and Pwnd: Leveraging ASCII Characters to Exploit VS Code
PortSwigger researcher Zakhar Fedotkin reveals a critical vulnerability in Visual Studio Code involving the abuse of ASCII control characters. The exploit targets node-pty, a library used by VS Code to simulate pseudo-terminals, which blindly forwards raw bytes to the shell. By injecting control characters like SOH (Start of Header) and ETX (End of Text) into configuration arguments or filenames, attackers can manipulate shell behavior. For instance, inserting SOH moves the cursor to the line's beginning, allowing malicious commands to overwrite legitimate ones. Additionally, dragging files with embedded control characters, such as ETX followed by a carriage return, can execute arbitrary commands like opening applications without user consent. This issue affects macOS and Ubuntu, where filesystems permit such characters in filenames, while Windows remains largely unaffected due to filesystem restrictions and PowerShell's handling of control codes. The research highlights how legacy communication protocols are repurposed in modern environments, creating unexpected security risks in popular development tools.
PortSwigger Research