GitHub Token Theft Via VS Code 1-Click Attack

1-Click GitHub Token Vulnerability Lets Attackers Steal Users’ OAuth Tokens via VS Code

A critical vulnerability in Visual Studio Code’s URI handling mechanism allows attackers to steal GitHub OAuth tokens through a single click. By exploiting the vscode:// protocol handler and the GitHub Pull Requests extension, threat actors can craft malicious links that trigger automatic authentication flows, exfiltrating valid GitHub tokens without additional user interaction. This attack bypasses standard browser security controls and poses significant risks to developers’ code repositories and CI/CD pipelines.

Introduction

Visual Studio Code has become the dominant code editor among developers worldwide, with the GitHub Pull Requests extension being one of its most popular additions. However, researchers have uncovered a sophisticated attack vector that leverages VS Code’s deep integration with GitHub to steal authentication tokens through carefully crafted links.

The vulnerability demonstrates how custom URI protocol handlers, designed for seamless user experience, can become attack vectors when proper security boundaries aren’t enforced. Unlike traditional phishing attacks requiring multiple steps or credential entry, this exploit requires just a single click on a malicious link—making it particularly dangerous in an era where developers routinely click links in documentation, forums, and code review comments.

Background & Context

Visual Studio Code implements custom protocol handlers through the vscode:// URI scheme, allowing web pages and external applications to trigger actions within the editor. This functionality enables features like opening projects directly from GitHub, installing extensions from marketplace listings, and deep-linking to specific files or settings.

The GitHub Pull Requests and Issues extension (vscode-pull-request-github) authenticates users through OAuth 2.0, storing access tokens locally to interact with GitHub’s API. This extension has over 10 million downloads and is considered essential infrastructure for modern development workflows.

OAuth 2.0’s authorization code flow typically provides strong security through multiple redirect steps and state parameters. However, when combined with custom protocol handlers that automatically launch applications, the security model can break down. The browser’s same-origin policy no longer provides protection once execution transfers to a desktop application.

Previous similar vulnerabilities have affected other development tools including GitKraken, Sourcetree, and various IDE plugins, but the widespread adoption of VS Code makes this attack vector particularly concerning.

Technical Breakdown

The attack chain consists of several coordinated steps that abuse legitimate functionality:

Step 1: Malicious Link Construction

Attackers craft a specially formatted URL that triggers VS Code’s protocol handler:

vscode://vscode.github-authentication/did-authenticate?code=AUTHORIZATION_CODE&state=STATE_VALUE

This URL mimics the legitimate OAuth callback structure that GitHub uses to return authorization codes to the VS Code extension.

Step 2: Protocol Handler Activation

When a user clicks the link, the operating system’s protocol handler registration automatically launches VS Code and passes the URL parameters to the GitHub authentication extension. No additional confirmation is required beyond the initial click.

Step 3: Authorization Code Exchange

The GitHub Pull Requests extension receives what it believes is a legitimate OAuth callback. It processes the authorization code and exchanges it with GitHub’s token endpoint:

POST https://github.com/login/oauth/access_token
Content-Type: application/json

{
  "client_id": "VSCODE_CLIENT_ID",
  "client_secret": "VSCODE_CLIENT_SECRET",
  "code": "ATTACKER_CONTROLLED_CODE",
  "redirect_uri": "vscode://vscode.github-authentication/did-authenticate"
}

Step 4: Token Exfiltration

Here’s where the attack succeeds: if the attacker controls the authorization code (obtained through various means including man-in-the-middle attacks, compromised OAuth flows, or social engineering), they can either:

• Race the victim to exchange the code first, obtaining the token directly
• Leverage the fact that some OAuth configurations allow multiple code exchanges
• Use the victim’s legitimate exchange while monitoring network traffic

Attack Variation: State Parameter Manipulation

A more sophisticated variant exploits insufficient state parameter validation:

vscode://vscode.github-authentication/did-authenticate?code=VALID_CODE&state=ATTACKER_CONTROLLED_STATE

If the extension doesn’t properly validate the state parameter against its own initiated flows, it may accept tokens from authentication sessions the attacker initiated but that the victim completed.

Impact & Risk Assessment

Severity Rating: HIGH (CVSS 8.1)

The potential impact of successful exploitation includes:

Code Repository Access

• Full read/write access to all repositories the victim can access
• Ability to inject malicious code into private and public projects
• Exfiltration of proprietary source code and intellectual property

CI/CD Pipeline Compromise

• Stolen tokens often have permissions to trigger GitHub Actions workflows
• Attackers can modify build processes to inject backdoors
• Supply chain attacks become trivial once repository access is gained

Organizational Exposure

• Many developers have admin access to organization repositories
• Compromised tokens may access organization secrets and sensitive configurations
• Lateral movement opportunities within development infrastructure

Attack Surface Factors

The vulnerability is particularly dangerous because:

• High likelihood of success: Developers constantly click repository links, documentation references, and code review comments
• Low detection probability: Legitimate VS Code launches appear identical to malicious ones
• Token longevity: GitHub OAuth tokens remain valid until explicitly revoked
• Silent exploitation: No visible indicators alert the victim that token theft occurred

Target Profile

High-value targets include:

• Open-source maintainers with repository write access
• Enterprise developers with access to proprietary codebases
• DevOps engineers with CI/CD configuration permissions
• Security teams with access to vulnerability disclosure repositories

Vendor Response

Microsoft and GitHub have coordinated on addressing this vulnerability through multiple mitigation layers:

Microsoft VS Code Updates (Version 1.82+)

• Enhanced validation of OAuth callback parameters
• Implementation of additional confirmation dialogs for authentication-related protocol handler invocations
• Improved state parameter generation and validation using cryptographically secure random values

GitHub Pull Requests Extension Patches (Version 0.72+)

• Strict state parameter validation against locally stored session data
• Time-window restrictions on authorization code acceptance
• Additional logging for security auditing purposes

GitHub Platform Changes

• Rate limiting on authorization code exchange endpoints
• Enhanced monitoring for suspicious OAuth flow patterns
• Improved token lifecycle management and rotation capabilities

Microsoft has assigned this issue CVE tracking and released security advisories through their standard MSRC channels. The fix has been auto-deployed to most VS Code installations through the built-in update mechanism.

Mitigations & Workarounds

Immediate Actions

Update to the latest versions immediately:

code --version

# Force update check
# Help > Check for Updates (GUI)

Ensure the GitHub Pull Requests extension is updated:

# List installed extensions with versions
code --list-extensions --show-versions | grep github

# Update all extensions
code --install-extension GitHub.vscode-pull-request-github --force

Token Revocation

Revoke existing GitHub OAuth tokens to invalidate potentially compromised credentials:

• Navigate to GitHub Settings > Applications > Authorized OAuth Apps
• Locate “Visual Studio Code”
• Click “Revoke access”
• Re-authenticate through VS Code after updating

Protocol Handler Restrictions

For high-security environments, consider restricting protocol handlers through system policies:

Windows Registry:

# Require confirmation for vscode:// protocol (requires admin)
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer" 
  -Name "NoProtocolHandlers" -Value 1 -PropertyType DWORD

macOS:

# Remove protocol handler association (requires re-registration)
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -u /Applications/Visual\ Studio\ Code.app

Detection & Monitoring

Network Monitoring

Monitor for unusual OAuth token exchange patterns:

# Example SIEM detection rule (Sigma format)
title: Suspicious VS Code OAuth Token Exchange
status: experimental
logsource:
  category: proxy
detection:
  selection:
    url|contains: 'github.com/login/oauth/access_token'
    user_agent|contains: 'VSCode'
  timeframe: 5m
  condition: selection | count() > 5

Endpoint Detection

Monitor for unexpected protocol handler invocations:

# PowerShell monitoring for vscode:// invocations
Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-Shell-Core/Operational'
  ID=9708
} | Where-Object {$_.Message -like "vscode://authentication*"}

GitHub Audit Logs

Regularly review OAuth token creation events:

• Organization Settings > Audit log
• Filter for oauth_application.create_token` events
• Investigate tokens created outside normal business hours or from unusual locations

User Behavior Analytics

Flag anomalous repository access patterns:

• Access to repositories never previously accessed
• Unusual commit patterns or timing
• Bulk repository cloning activity

Best Practices

Secure Development Environment Configuration

• Enable Multi-Factor Authentication: Require MFA for all GitHub accounts to limit token compromise impact
• Use Fine-Grained Personal Access Tokens: Instead of full OAuth tokens, use GitHub's new fine-grained tokens with minimal necessary permissions:

# Configure Git to use fine-grained token
git config --global credential.helper store
# Use token with read-only access when possible

• Implement Token Rotation Policies: Regularly rotate OAuth tokens even without confirmed compromise:

// Example automated token rotation script
const rotationPolicy = {
  maxTokenAge: 30  24  60  60  1000, // 30 days
  autoRevoke: true
};

• Network Segmentation: Isolate development environments from general corporate networks

Security Awareness

• Train developers to verify URLs before clicking, especially in public forums
• Implement link scanning for development team communication channels
• Use preview features before following links in untrusted sources
• Be suspicious of links shared in GitHub issues, especially from new contributors

Extension Security

• Regularly audit installed VS Code extensions
• Only install extensions from verified publishers
• Review extension permissions before installation
• Monitor extension update notifications for security patches

Organizational Policies

• Implement GitHub organization-level OAuth application restrictions
• Use SAML SSO to add additional authentication layers
• Deploy GitHub Enterprise with IP allowlisting where appropriate
• Regular security audits of repository access permissions

Key Takeaways

• Custom protocol handlers create unique attack surfaces that bypass traditional browser security controls, requiring additional security validation beyond web-based flows.
• Single-click attacks are highly effective against even security-conscious users when exploiting trusted tools and workflows developers use dozens of times daily.
• OAuth security depends on proper state validation and ensuring authorization codes can only be exchanged once by the legitimate initiating party.
• Defense in depth remains critical: No single mitigation fully prevents this attack class; layered defenses including updates, monitoring, token rotation, and user awareness work together.
• Developer tools are high-value targets: Compromising a developer's environment provides attackers with access to intellectual property, supply chains, and production infrastructure.
• Automatic updates are essential security controls: The majority of VS Code users remained protected because automatic updates deployed patches before widespread exploitation.

This vulnerability underscores the importance of security-conscious design in developer tooling and the need for continuous vigilance even in trusted software supply chains.

References

• Microsoft Security Response Center Advisory: VS Code OAuth Token Handling
• GitHub Security Lab: Custom Protocol Handler Vulnerabilities
• VS Code GitHub Authentication Extension Security Update Release Notes
• OAuth 2.0 Security Best Current Practice (RFC 8252)
• MITRE ATT&CK Technique T1528: Steal Application Access Token
• CVE Database Entry: GitHub Token Theft via VS Code Protocol Handler
• Visual Studio Code Documentation: Security and URI Handlers

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/