Spoofing attack in Visual Studio - CVE-2023-28299

Detailed vulnerability description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of newline characters in extension's name. A remote attacker can manually add newline characters to the tag <DisplayName> under the "extension.vsixmanifest" file, which will hide information about digital signature of an unsigned extension leading to a spoofing attack.

Successful exploitation of the vulnerability will require a victim to install a malicious extension.

How to mitigate CVE-2023-28299

Sources

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-28299
• https://www.varonis.com/blog/visual-studio-bug