Attacking Language Server JSON RPC

While auditing a VSCode Extension + Language Server I noticed something interesting. This turned into the research question "can we attack the extension from the browser?". After a bit of preliminary research I decided to do it again on stream, and eventually made this video. This is how security research can look like.

Chapters:
00:00 - Why Security Research?
01:23 - What is a Language Server?
02:53 - Setup Example Code
04:00 - RCE in VSCode Extension?
05:25 - The Language Server Code
06:29 - Researching Communication
11:13 - Can a Browser Attack the VSCode Extension?
13:54 - Research Results
15:40 - Ad n' Outro

=[ ❤️ Support ]=

=[ 🐕 Social ]=

[Dominik-K]

There's no failed research, just fruitless attempts. And I learned a bit about the language server protocol too

[MechMK]

This reminds me of a project I was involved in for the past couple of weeks. Review of source code, really did a deep dive into it. Thousands of class files, going from broad architecture all the way to functional implementation. The final verdict? "Looks good, ship it"

Just because you try really hard to find a vuln doesn't always mean there is one to find.

[sadDota]

that was awesome, ty
showed me that research is not always/ doesn't need to always be fruitful, and now thinking about it I feel much better 😁

[geraldschittenhelm]

It isn't even fruitless. You checked it, found no vulnerabilities, gained knowledge about VsCode Extensions.
Nice work! 👍

[logiciananimal]

Great work - I don't regard the *research* as a failure; merely one avenue for exploitation is not seemingly possible - and that itself is a good result to communicate or at least know about.

[alexanderdell]

It would be cool to do such content more often in live and upload recordings to the second channel.
A good reminder that a research is when you fail significantly more times than you succeed

[znxster]

Learning what fails is often as important as learning what succeeds.

[tajsec]

I love this video, it was great way of showing even failed research can teach us a lot.

[somesalmon]

In the on screen text at around 7:30 you wrote the word mess twice!

Amazing video though, incredibly informative and deep information :) I appreciate your work!

[AndreasWilfer]

Great and very realistic showcase about how (security) research goes. Good job!

[till]

im currently writing vscode language support for my own language, so this is very interessting

[sirishakotikalapudi]

This channel and your content is very helpful in understanding how to go about security research and finding bugs. I have one question though : Are there any tools to identify how client applications communicate with servers without looking at the code ?(Or if the client app code is not available )

[strager_]

14:13 Could you write the second message in the body of the first message? The first message's HTTP body would be:

123

{malicious-request}

[Isti]

Wow, you just blew my mind with the solution to the problem at 13:20! 😃
I even paused to try and come up with my own idea, but didn't realize such a simple trick is enough...

[testtest-xzec]

This is not the first video of this channel about language servers. The video "Google Paid Me to Talk About a Security Issue!
" it is explained how a language server with hacker controlled code can be used to execute code.

[RealCyberCrime]

I’m thinking about making a similar video in documentary format

[Idkwtmmythandle]

Thank you for posting this type of process! Learned a lot, and hopefully will be able to do research myself one day, thanks for all the quality content.

[dunste]

It's pretty cool to learn how the protocol works

[anon_y_mousse]

You tried Chrome for pipelining, but several other browsers still have it. Also, wouldn't multiplexing work just as well?

[notapplicable]

Oh this sparked my interest in vscode extensions. Definitely on my list of things to play around with some time.