Improper object validation allows for arbitrary code execution in GitOps Tools Extension for VSCode

Vulnerability

The GitOps Tools Extension for VSCode (versions prior to the fix released in August 2022) fails to properly validate specially crafted Flux objects. A malicious Flux object can be loaded by the extension, leading to remote code execution in the context of the user running VSCode [1].

Exploitation

An attacker who can introduce a crafted Flux object to a cluster shared with other users can exploit this vulnerability. The user must open the malicious object with the VSCode extension for the code path to be triggered. No additional authentication is required beyond access to the cluster [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the machine running VSCode, with the privileges of the VSCode user. This can lead to full compromise of the development environment and access to credentials or other secrets [1].

Mitigation

The only safe mitigation is to update the GitOps Tools Extension to the latest version as of August 2022. No workaround is available. The vulnerability was fixed by the vendor in a patched release [1].