Comment by jasomill
16 hours ago
This.
The ability to remotely run arbitrary code on a machine that intentionally gives SSH shell and write+execute access to the filesystem is not a vulnerability just because it's a productivity aid to users who want to leverage this access to do bad things on the remote machine.
A remote access protocol that gives a potentially untrustworthy remote system the ability to execute arbitrary code on the local machine is a serious problem in any scenario where the remote connection is presumed to be a one-way trust boundary.
Which of course includes any scenario where I myself deliberately run untrustworthy code on the remote, no matter how much I trust the remote itself and its owners.
There's also the risk that VS Code is a "trusted" application in many enterprises because developers force it to be. VS Code's node runtime (and plugin system) executing somewhat arbitrary Javascript means that any dev servers become vulnerable to exploits you otherwise might not have prepared to defend against [1].
Otherwise, you could see Javascript running on a server and instantly know something was odd, depending on the server.
[1] - https://www.darktrace.com/blog/darktrace-identifies-campaign...