{"uuid": "21ca8bba-e3af-4a60-84b7-7e02d454ea15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-28299", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/105700", "content": "Black Hat Ethical Hacking\nMicrosoft Visual Studio Flaw Enables Impersonation of Trusted Publishers\n\nMicrosoft Visual Studio Flaw Enables Impersonation of Trusted PublishersPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nVaronis Threat Labs has discovered a significant user interface (UI) bug (CVE-2023-28299) in Microsoft Visual Studio\u2019s extension installer. This vulnerability allows attackers to manipulate extension signatures, effectively impersonating any publisher. Microsoft promptly addressed the issue by releasing a patch for CVE-2023-28299 on April 11, 2023.\n\nFailure to apply the patch leaves systems susceptible to targeted attacks, as threat actors can distribute malicious extensions to compromise vulnerable systems.\n\nWhy is this a matter of concern? Visual Studio, the second most popular Integrated Development Environment (IDE) in the market, boasts a substantial user base of over thirty thousand customers, commanding a significant 26% market share.\n\nVisual Studio\u2019s appeal lies in its extensive collection of extensions, which range from integrating GitHub and SQL servers to simple productivity tools like spell checks and code snippets. The most popular extensions often accumulate millions of downloads. However, the UI bug discovered by Varonis Threat Labs (CVE-2023-28299) exposes a critical risk: threat actors can impersonate well-known publishers and distribute malicious extensions to compromise targeted systems. These malicious extensions have been known to facilitate data theft, unauthorized code access and alteration, and even complete system takeover.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe nature of the bug revolves around Visual Studio\u2019s prevention of newline characters within an extension\u2019s name, specifically by blocking user input in the \u201cProduct Name\u201d extension property. However, this restriction can be easily bypassed by opening the VSIX file as a ZIP archive and manually adding newline characters to the \u201c<displayname\u201d tag in the \u201cextension.vsixmanifest\u201d file.\n\n \nhttps://info.varonis.com/hubfs/image-png-3.png Creating a new C# project and editing its property\nhttps://info.varonis.com/hubfs/image-png-Jun-02-2023-12-25-29-4200-AM.png Editing in 7zip\nBy adding a sufficient number of newline characters, the extension\u2019s name pushes down the remaining text in the Visual Studio installation prompt, effectively concealing the warning \u201cDigital Signature: None.\u201d Spoofing SignaturesThis exploit allows threat actors to create a spoofed extension that appears legitimate but lacks a digital signature, a critical indicator of authenticity. Furthermore, the threat actor gains control over the extension\u2019s signature area, enabling them to insert fake \u201cDigital Signature\u201d text that appears genuine to the user.\n\nhttps://info.varonis.com/hubfs/image-png-Jun-02-2023-12-33-32-5189-AM.png Real extension with digital signature\nhttps://info.varonis.com/hubfs/image-png-Jun-02-2023-12-33-23-9129-AM.png Extension without digital signature\nhttps://info.varonis.com/hubfs/image-png-Jun-02-2023-12-33-14-1777-AM.png Extension with spoofed signature\nTrending: Write up: Find hidden and encrypted secrets from any website Trending: Offensive Security Tool: Pypykatz\nThe attack scenario unfolds primarily through phishing techniques. Here\u2019s an example:\n\n1. The attacker disguises an email as a legitimate software update, targeting company developers.\n2. The email includes the spoofed VSIX extension, mimicking the appearance of a genuine update.\n3. Unable to differentiate the malicious VSIX from a legitimate signed update, the victim [...]", "creation_timestamp": "2026-09-05T01:00:27.851049Z"}