CVE-2023-46248 Overwrite of builtin Cody commands facilitates RCE
Attackers can achieve remote code execution by tricking users into opening malicious repositories with overwritten Cody commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-46248?
CVE-2023-46248 is a critical code injection vulnerability in sourcegraph cody, published on 31 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file `.vscode/cody.json` and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user's machine. The vulnerability is rated as critical severity, but with low exploitability. It requires the user to have a malicious repository loaded and execute the overwritten command in VS Code. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. The issue was found during a regular 3rd party penetration test. The maintainers of Cody do not have evidence of open source repositories having malicious `.vscode/cody.json` files to exploit this vulnerability. The issue is fixed in version 0.14.1 of the Cody VSCode extension. In case users can't promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded.
Weakness: CWE-15
Which versions are affected by CVE-2023-46248?
It affects 1 product.
Products include Sourcegraph Cody.
How do I fix CVE-2023-46248?
No fix has been published for CVE-2023-46248 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-46248 being exploited?
There is no known exploitation of CVE-2023-46248 in the wild and no public exploit code.