June 12, 2023Ravi LakshmananVulnerability/Software

Security researchers find ‘easily exploitable’ flaw in Microsoft Visual Studio installer that could be exploited by malicious actors to impersonate legitimate publishers and distribute malicious extensions warned that there is

“Threat actors can masquerade as popular publishers and issue malicious extensions to compromise targeted systems,” said Varonis researcher Dolev Taler. Said. “Malicious extensions are used to steal sensitive information, silently access and modify code, or gain complete control over a system.”

Vulnerabilities tracked as CVE-2023-28299 (CVSS score: 5.5) has been addressed by Microsoft as part of the April 2023 Patch Tuesday update and has been described as an impersonation flaw.

cyber security

A bug discovered by Varonis has to do with the Visual Studio user interface that allows for the spoofing of a publisher’s digital signature.

Specifically, if the user has a Visual Studio extension (VSIX) save the package as a .ZIP file and add it manually newline character Add it to the “DisplayName” tag in the “extension.vsixmanifest” file.

Microsoft Visual Studio

By introducing enough newline characters into the vsixmanifest file and adding bogus “digital signature” text, you can easily suppress the warning about the extension not being digitally signed, tricking the developer into installing the extension. It turned out that it can be done.

upcoming webinars

🔐 Mastering API Security: Understanding Your True Attack Surface

Discover untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join us for an insightful webinar!

join the session

In a hypothetical attack scenario, a malicious attacker could send a phishing email containing a spoofed VSIX extension disguised as a legitimate software update and, after installation, gain a foothold in the target machine. There is a nature.

Unauthorized access could be used as a launch pad to gain deeper control over networks and facilitate theft of sensitive information.

“The low complexity and required permissions make this exploit easy to weaponize,” Taler said. “Threat actors may use this vulnerability to issue spoofed malicious extensions with the intent of compromising systems.”

Did you enjoy this article? Follow us twitter and LinkedIn To read more of the exclusive content we post.



Register now for our membership to gain access to our elite training program and fast forward your career today!


Subscribe my Newsletter for new blog posts, tips & new photos. Let's stay updated!

Security Blog

Blue Training Academy

Blue Training Academy was developed in 2018 as a educational and training facility for continuing education and certification courses. Blue Training Academy is an educational institution that allows for all sectors of the public and Criminal Justice field to gain ongoing training and education.

Copyright ©️ All rights reserved. | Blue Training Academy Blog