Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
CVSS Details
CVSS Score
5.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Visual Studio Code (具体受影响版本请参考官方安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import os
# This script demonstrates the concept of the Relative Path Traversal vulnerability.
# In a vulnerable version of VS Code, opening a file with a crafted path
# could allow reading files outside the intended workspace.
def simulate_vulnerable_file_open(workspace_path, file_path):
"""
Simulates a vulnerable file open function that does not sanitize paths.
"""
# The vulnerability lies here: directly joining paths without checking for traversal
full_path = os.path.normpath(os.path.join(workspace_path, file_path))
# Check if the resolved path escapes the workspace (Vulnerability)
if not full_path.startswith(os.path.normpath(workspace_path)):
print(f"[!] SECURITY ALERT: Path traversal detected!")
print(f"[!] Attempting to access: {full_path}")
return full_path
return full_path
# Configuration
workspace = "/home/user/vscode-project"
# Malicious payload using relative path traversal
payload = "../../../../../../etc/passwd"
print(f"[*] Workspace: {workspace}")
print(f"[*] Malicious Payload: {payload}")
result = simulate_vulnerable_file_open(workspace, payload)
if result:
print(f"[+] Resolved Path: {result}")
print("[+] In a real exploit, the content of this file would be disclosed.")