CVE-2020-17148 Detail

Current Description

Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability


Analysis Description

Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability

Severity

CVSS 3.x Severity and Metrics:

NIST:NVD
Vector:NVD
Vector:
HyperlinkResource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-17148PatchVendor Advisory

Welcome to the March 2020 release of Visual Studio Code. There are a number of updates in this version that we hope you will like, some of the key highlights include: Accessibility improvements - Easier diff view navigation, clearer role designations for UI controls. In Visual Studio there is an option to avoid autocompletion from pulling stuff from Windows and all third party stuff, so autocompletion only looks for your current project code. Open the Terminal in Visual Studio Code by selecting View Terminal from the main menu. The Terminal opens with the command prompt in the HelloWorldApi folder. In the Terminal, enter the following command: dotnet new webapi. C:HelloWorldApi dotnet new webapi The template 'ASP.NET Core Web API' was created successfully.

Weakness Enumeration

CWE-IDCWE NameSource
CWE-94Improper Control of Generation of Code ('Code Injection')NIST

Known Affected Software Configurations Switch to CPE 2.2

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

3 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2020-17148
NVD Published Date:
12/09/2020
NVD Last Modified:
03/03/2021
Source:
Microsoft Corporation
Studio

Microsoft’s Visual Studio Code is the new supported IDE for C++ and Java development in FRC, replacing the Eclipse IDE used from 2015-2018. This article introduces some of the basics of using Visual Studio Code and the WPILib extension.

Welcome Page¶

When Visual Studio Code first opens, you are presented with a Welcome page. On this page you will find some quick links that allow you to customize Visual Studio Code as well as a number of links to help documents and videos that may help you learn about the basics of the IDE as well as some tips and tricks.

You may also notice a small WPILib logo way up in the top right corner. This is one way to access the features provided by the WPILib extension (discussed further below).

User Interface¶

Visual Studio Code 2020 C++ Hello World

The most important link to take a look at is probably the basic User Interface document. This document describes a lot of the basics of using the UI and provides the majority of the information you should need to get started using Visual Studio Code for FRC.

Studio

Command Palette¶

The Command Palette can be used to access or run almost any function or feature in Visual Studio Code (including those from the WPILib extension). The Command Palette can be accessed from the View menu or by pressing Ctrl+Shift+P (Cmd+Shift+P on macOS). Typing text into the window will dynamically narrow the search to relevant commands and show them in the dropdown.

In the following example “wpilib” is typed into the search box after activating the Command Palette, and it narrows the list to functions containing WPILib.

WPILib Extension¶

The WPILib extension provides the FRC® specific functionality related to creating projects and project components, building and downloading code to the roboRIO and more. You can access the WPILib commands one of two ways:

  • By typing “WPILib” into the Command Palette

  • By clicking on the WPILib icon in the top right of most windows. This will open the Command Palette with “WPILib” pre-entered

Note

Next Version Of Visual Studio

It is not recommended to install the Visual Studio IntelliCode plugin with the FRC installation of VS Code as it is known to break IntelliSense in odd ways.

Update Visual Code

For more information about specific WPILib extension commands, see the other articles in this chapter.