Parsia Hakimian personal blog
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2…
- Points
- 327
- HN comments
- 102
- Submissions
- 1
- Cited by
- 4 commenters
Security & PrivacySoftware Engineering2021
On Hacker News
| Submitted | Title on HN | Points | Comments |
|---|---|---|---|
| Dec 21, 2021 | RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit by gmemstr | 327 | 102 |
Cited in comments
Linked from 4 Hacker News comments by 4 different people, from Dec 2021 to Sep 2023.
Most recent:
- foob · Sep 4, 2023
- mananaysiempre · Jan 2, 2023
- throw10920 · Dec 21, 2021
- azalemeth · Dec 21, 2021
