CVE-2024-3423: One-Click RCE via Markdown Link Command Injection in VS Code Markdown Preview Enhanced

Vulnerability Summary: One Click RCE via Markdown Link Command Injection on Windows Vulnerability Overview Vulnerability Name: One Click RCE via Markdown Link Command Injection on Windows Vulnerability Type: Command Injection Affected Component: Markdown Preview Enhanced extension (VS Code extension) Vulnerability Description: - When a user clicks on a maliciously crafted Markdown link, the extension injects the command contained within the link into the Windows command line for execution. - Attackers can trigger arbitrary command execution by crafting special links (e.g., or ). - Exploitation requires no additional user actions beyond clicking the link. - The extension fails to sufficiently filter or escape command parameters during link parsing, leading to command injection. Scope of Impact Affected Software: Markdown Preview Enhanced (VS Code extension) Affected Systems: Windows Operating System Affected Versions: All unpatched versions (as of the release of CVE-2024-3423) CVSS Score: 8.2/10 (High Severity) Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Local Confidentiality/Integrity/Availability: High Remediation Official Fix: The developer has released a patched version; users are advised to immediately update the extension to the latest version. Temporary Mitigation Measures: - Avoid clicking on Markdown links from untrusted sources. - Disable the "Preview" feature of the Markdown Preview Enhanced extension or restrict its execution environment. - Open suspicious Markdown files in a sandbox or isolated environment. Long-term Recommendations: - Regularly update VS Code and its extensions. - Enable VS Code security settings to restrict extension permissions. - Perform static scanning on Markdown files to detect potential malicious links. POC Code / Exploit Code > Note: The code above is for demonstration purposes only. Actual attacks may involve more complex command combinations or malicious payloads. Do not test or run such code in production environments. Additional Information CVE Identifier: CVE-2024-3423 Disclosure Date: June 18, 2024 Reporter: @hackerone (Anonymous) Fix Status: Fixed Related Resources: - GitHub Repository - CVE Details - HackerOne Report --- Security Advisory: This vulnerability has a high exploitability rating. All Windows users are strongly advised to immediately update the Markdown Preview Enhanced extension and exercise caution when handling Markdown files from unknown sources.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-3423: One-Click RCE via Markdown Link Command Injection in VS Code Markdown Preview Enhanced

More from this source