Found in the v0.8.0 pre-release review. Low severity, filed rather than fixed because the obvious mitigation would break a legitimate workflow.
What happens
WorkingFolder is restored verbatim from state.json and reached automatically, with no scheme check:
GitService.GetGitInfoAsync calls Directory.Exists(folderPath) on every pollGitRepoWatcher.Acquire resolves and watches <folder>\.git
If the value is \attacker.example\share\repo, Windows performs an SMB connection to that host during session restore. On a default configuration that means an outbound NTLM authentication attempt — i.e. a net-NTLMv2 hash leak, crackable offline or relayable — with no user interaction beyond opening the app.
Reachability
state.json is normally written by the app, so this needs the file to be attacker-influenced:
ImportExportService deserializes a whole AppState from any JSON file the user opens — the documented "settings + sessions backup" flow, and the same trust boundary that RunInstance.IsLaunchableUrl already exists to guard.- A shared or synced profile directory.
Why not simply block UNC paths
People legitimately keep repos on network shares, and CSM already supports \wsl$\… UNCs as a first-class working-folder shape for WSL sessions — the WSL feature depends on exactly this path form. A blanket rejection would break both.
Options
- Treat non-
\wsl$/\wsl.localhost UNC working folders as untrusted on import only, and prompt once listing the hosts about to be contacted.
- Mark imported sessions dormant, so nothing is probed until the user explicitly wakes one. Cheapest, and reuses machinery that already exists.
- Do nothing, and document it.
Option 2 is probably the right trade: import already produces a set of sessions the user has not vouched for, and dormant-until-woken is a reasonable default for that regardless of this issue.
Related
Found in the v0.8.0 pre-release review. Low severity, filed rather than fixed because the obvious mitigation would break a legitimate workflow.
What happens
WorkingFolderis restored verbatim fromstate.jsonand reached automatically, with no scheme check:GitService.GetGitInfoAsynccallsDirectory.Exists(folderPath)on every pollGitRepoWatcher.Acquireresolves and watches<folder>\.gitIf the value is
\attacker.example\share\repo, Windows performs an SMB connection to that host during session restore. On a default configuration that means an outbound NTLM authentication attempt — i.e. a net-NTLMv2 hash leak, crackable offline or relayable — with no user interaction beyond opening the app.Reachability
state.jsonis normally written by the app, so this needs the file to be attacker-influenced:ImportExportServicedeserializes a wholeAppStatefrom any JSON file the user opens — the documented "settings + sessions backup" flow, and the same trust boundary thatRunInstance.IsLaunchableUrlalready exists to guard.Why not simply block UNC paths
People legitimately keep repos on network shares, and CSM already supports
\wsl$\…UNCs as a first-class working-folder shape for WSL sessions — the WSL feature depends on exactly this path form. A blanket rejection would break both.Options
\wsl$/\wsl.localhostUNC working folders as untrusted on import only, and prompt once listing the hosts about to be contacted.Option 2 is probably the right trade: import already produces a set of sessions the user has not vouched for, and dormant-until-woken is a reasonable default for that regardless of this issue.
Related