CVE-2021-30124
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running the unofficial vscode-phpmd extension for Visual Studio Code. Attackers can exploit a crafted phpmd.command value in workspace folders to achieve remote code execution. Users of Visual Studio Code with the vulnerable extension installed are affected.
💻 Affected Systems
- vscode-phpmd (unofficial PHP Mess Detector extension for Visual Studio Code)
📦 What is this software?
Vscode Phpmd by Vscode Phpmd Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the developer's machine, potentially leading to data theft, lateral movement, or ransomware deployment.
Likely Case
Attackers execute malicious code within the developer's environment, potentially stealing source code, credentials, or installing backdoors.
If Mitigated
Limited impact with proper network segmentation and least privilege controls, potentially isolated to the user's development environment.
🎯 Exploit Status
Exploitation requires the attacker to control or influence the phpmd.command value in workspace settings.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.0 and later
Vendor Advisory: https://github.com/sandhje/vscode-phpmd/commit/c462bf5c6f0160d0199855d5f8ed76be8d9beac0
Restart Required: Yes
Instructions:
1. Open Visual Studio Code. 2. Go to Extensions view. 3. Search for 'vscode-phpmd'. 4. Click Update or reinstall to get version 1.3.0+. 5. Restart Visual Studio Code.
🔧 Temporary Workarounds
Disable extension
allTemporarily disable the vscode-phpmd extension until patched
code --disable-extension ecodes.vscode-phpmd
Remove extension
allUninstall the vulnerable extension completely
code --uninstall-extension ecodes.vscode-phpmd
🧯 If You Can't Patch
- Restrict workspace folder access to trusted sources only
- Implement network segmentation to isolate development environments
🔍 How to Verify
Check if Vulnerable:
Check extension version in VS Code Extensions view or run: code --list-extensions --show-versions | grep vscode-phpmdCheck Version:
code --list-extensions --show-versions | grep vscode-phpmdVerify Fix Applied:
Verify installed version is 1.3.0 or higher using same command📡 Detection & Monitoring
Log Indicators:
- Unusual command execution from vscode-phpmd extension
- Suspicious phpmd.command values in workspace settings
Network Indicators:
- Unexpected outbound connections from VS Code process
SIEM Query:
process_name:vscode AND command_line:*phpmd.command*🔗 References
- https://github.com/sandhje/vscode-phpmd/commit/c462bf5c6f0160d0199855d5f8ed76be8d9beac0
- https://marketplace.visualstudio.com/items?itemName=ecodes.vscode-phpmd
- https://vuln.ryotak.me/advisories/25
- https://github.com/sandhje/vscode-phpmd/commit/c462bf5c6f0160d0199855d5f8ed76be8d9beac0
- https://marketplace.visualstudio.com/items?itemName=ecodes.vscode-phpmd
- https://vuln.ryotak.me/advisories/25
