{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-46248", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-10-19T20:34:00.948Z", "datePublished": "2023-10-31T15:11:46.707Z", "dateUpdated": "2023-10-31T15:11:46.707Z"}, "containers": {"cna": {"title": "Overwrite of builtin Cody commands facilitates RCE", "problemTypes": [{"descriptions": [{"cweId": "CWE-15", "lang": "en", "description": "CWE-15: External Control of System or Configuration Setting", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/sourcegraph/cody/security/advisories/GHSA-8wmq-fwv7-xmwq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sourcegraph/cody/security/advisories/GHSA-8wmq-fwv7-xmwq"}, {"name": "https://github.com/sourcegraph/cody/pull/1414", "tags": ["x_refsource_MISC"], "url": "https://github.com/sourcegraph/cody/pull/1414"}], "affected": [{"vendor": "sourcegraph", "product": "cody", "versions": [{"version": ">= 0.10.0, < 0.14.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-10-31T15:11:46.707Z"}, "descriptions": [{"lang": "en", "value": "Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file `.vscode/cody.json` and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user's machine. The vulnerability is rated as critical severity, but with low exploitability. It requires the user to have a malicious repository loaded and execute the overwritten command in VS Code. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. The issue was found during a regular 3rd party penetration test. The maintainers of Cody do not have evidence of open source repositories having malicious `.vscode/cody.json` files to exploit this vulnerability. The issue is fixed in version 0.14.1 of the Cody VSCode extension. In case users can't promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded."}], "source": {"advisory": "GHSA-8wmq-fwv7-xmwq", "discovery": "UNKNOWN"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sourcegraph:cody:*:*:*:*:*:*:*:*", "matchCriteriaId": "D70F86B8-E8B8-4C28-9AFF-688A3CD4EF34", "versionEndIncluding": "0.14.0", "versionStartIncluding": "0.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cody is an artificial intelligence (AI) coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file `.vscode/cody.json` and overwrite Cody commands. If a user with the extension installed opens this malicious repository and runs a Cody command such as /explain or /doc, this could allow arbitrary code execution on the user's machine. The vulnerability is rated as critical severity, but with low exploitability. It requires the user to have a malicious repository loaded and execute the overwritten command in VS Code. The issue is exploitable regardless of the user blocking code execution on a repository through VS Code Workspace Trust. The issue was found during a regular 3rd party penetration test. The maintainers of Cody do not have evidence of open source repositories having malicious `.vscode/cody.json` files to exploit this vulnerability. The issue is fixed in version 0.14.1 of the Cody VSCode extension. In case users can't promptly upgrade, they should not open any untrusted repositories with the Cody extension loaded."}, {"lang": "es", "value": "Cody es un asistente de codificaci\u00f3n de inteligencia artificial (IA). Las versiones de la extensi\u00f3n Cody AI VSCode 0.10.0 a 0.14.0 son vulnerables a la ejecuci\u00f3n remota de c\u00f3digo bajo ciertas condiciones. Un atacante que tenga el control de un repositorio malicioso podr\u00eda modificar el archivo de configuraci\u00f3n de Cody `.vscode/cody.json` y sobrescribir los comandos de Cody. Si un usuario con la extensi\u00f3n instalada abre este repositorio malicioso y ejecuta un comando Cody como /explain o /doc, esto podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario en la m\u00e1quina del usuario. La vulnerabilidad est\u00e1 clasificada como de gravedad cr\u00edtica, pero con baja explotabilidad. Requiere que el usuario tenga cargado un repositorio malicioso y ejecute el comando sobrescrito en VS Code. El problema se puede explotar independientemente de que el usuario bloquee la ejecuci\u00f3n del c\u00f3digo en un repositorio a trav\u00e9s de VS Code Workspace Trust. El problema se encontr\u00f3 durante una prueba de penetraci\u00f3n habitual de terceros. Los mantenedores de Cody no tienen evidencia de que los repositorios de c\u00f3digo abierto tengan archivos maliciosos `.vscode/cody.json` para explotar esta vulnerabilidad. El problema se solucion\u00f3 en la versi\u00f3n 0.14.1 de la extensi\u00f3n Cody VSCode. En caso de que los usuarios no puedan actualizar r\u00e1pidamente, no deben abrir ning\u00fan repositorio que no sea de confianza con la extensi\u00f3n Cody cargada."}], "id": "CVE-2023-46248", "lastModified": "2023-11-08T17:49:04.180", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-10-31T16:15:09.777", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit"], "url": "https://github.com/sourcegraph/cody/pull/1414"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sourcegraph/cody/security/advisories/GHSA-8wmq-fwv7-xmwq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-15"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}