CVE-2021-28793
📋 TL;DR
CVE-2021-28793 is an incorrect access control vulnerability in the vscode-restructuredtext extension for Visual Studio Code. It allows arbitrary binary execution via crafted workspace configurations when opening malicious project folders. Users of the affected extension versions are vulnerable.
💻 Affected Systems
- vscode-restructuredtext Visual Studio Code extension
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution with user privileges, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or execution of malicious payloads when users open untrusted project folders containing crafted workspace configurations.
If Mitigated
No impact if extension is updated or if users only open trusted project folders from verified sources.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious project folder). Proof of concept details are publicly available in vulnerability reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 147.0.0
Vendor Advisory: https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases/tag/147.0.0
Restart Required: Yes
Instructions:
1. Open Visual Studio Code. 2. Go to Extensions view (Ctrl+Shift+X). 3. Search for 'reStructuredText'. 4. Click Update or reinstall extension. 5. Restart VS Code.
🔧 Temporary Workarounds
Disable extension
allTemporarily disable the vscode-restructuredtext extension until patched.
code --disable-extension lextudio.restructuredtext
Restrict project sources
allOnly open project folders from trusted sources and verified repositories.
🧯 If You Can't Patch
- Implement application allowlisting to restrict execution of unauthorized binaries
- Use sandboxed development environments or containers for untrusted projects
🔍 How to Verify
Check if Vulnerable:
Check extension version in VS Code Extensions view. If version is below 146.0.0, you are vulnerable.Check Version:
code --list-extensions --show-versions | findstr restructuredtextVerify Fix Applied:
Verify extension version is 147.0.0 or higher in Extensions view.📡 Detection & Monitoring
Log Indicators:
- Unexpected binary execution from VS Code process
- Workspace configuration files with suspicious commands
Network Indicators:
- Outbound connections from VS Code to unexpected destinations
SIEM Query:
process_name:vscode AND (process_command_line:*restructuredtext* OR parent_process:vscode)🔗 References
- https://github.com/vscode-restructuredtext/vscode-restructuredtext/commit/1dd3e878a5559e3dfe0e48f145c90418b208c5af
- https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases
- https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases/tag/147.0.0
- https://vuln.ryotak.me/advisories/37
- https://github.com/vscode-restructuredtext/vscode-restructuredtext/commit/1dd3e878a5559e3dfe0e48f145c90418b208c5af
- https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases
- https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases/tag/147.0.0
- https://vuln.ryotak.me/advisories/37
