Exploitable Microsoft Visual Studio Bug Opens Developers to Takeover

[upnorth]

Content source

https://www.darkreading.com/application-security/researchers-warn-of-easily-exploitable-spoofing-bug-in-visual-studio

Security researchers are warning about a bug in Microsoft Visual Studio installer that gives cyberattackers a way to create and distribute malicious extensions to application developers, under the guise of being a legitimate software publisher. From there, they could infiltrate development environments, taking control, poisoning code, stealing high-value intellectual property, and more.

Microsoft issued a patch for the spoofing vulnerability—tracked as CVE-2023-28299—with its monthly security update for April. At the time the company described the vulnerability as being of moderate severity and assessed it as a bug that attackers are less likely to exploit. But in a blog this week, researchers from Varonis who discovered the vulnerability originally offered a slightly different take on the bug and its potential impact.According to the posting, the bug merits attention because it's easily exploitable and exists in a product with a 26% market share and more than 30,000 customers.

"With the UI bug found by Varonis Threat Labs, a threat actor could impersonate a popular publisher and issue a malicious extension to compromise a targeted system," Varonis security researcher Dolor Taler wrote. "Malicious extensions have been used to steal sensitive information, silently access and change code, or take full control of a system."

The vulnerability that Varonis discovered affects multiple versions of the Visual Studio integrated development environment (IDE)—from Visual Studio 2017 to Visual Studio 2022. The flaw involves the ability for anyone to easily bypass a security restriction in Visual Studio that prevents users from entering information in the "product name" extension property.

Easily Exploitable Microsoft Visual Studio Bug Opens Developers to Takeover

The bug is very dangerous and impacts a big swath of the developer community, researchers warn.

www.darkreading.com

 

[R3j3ct]

if i'm not mistaken didn't this happen with vb6 too?(back many moons ago) you would think that this sorta thing would be, ..fixed, or at least, microsoft would look into such things & keep checking for stuff like this before just jamming it down people's throats making it the new NORM, and keep checking, there security updates are a joke, never made until the wild finds it? i understand that if there's a will there's a way, but for how much microsoft charges, you would think instead of letting the wild find these, maybe have staff do a follow up for vulnerabilities of there product? just my 2 cents