Full Report
Cross-site frame counting is a technique for counting the amount of window references (iFrames) from external websites. This is not a vulnerability by itself but can be used to leak private information. For instance, if there's an iFrame for a user logged into a site and no iFrame if not, then this leaks that the user is logged in. - While testing VS-Codespaces integration with Github, the author noticed a quirk about the iFrames: 2 iFrames2 iFrames: The private repository exists but the file does not. 1 iFrame: The private repository exists and the file both exist. 0 iFrames: The private repository does not exist. So, we can determine the state of a user based upon the number of frames. Neat! The exploit is a loop of opening a location in the browser by setting the win.location and checking how many frames were loaded. How do you fix this? You load a consistent number of iFrames no matter the state. Overall, interesting bug with pretty significant impact.
Analysis Summary
# Vulnerability: Information Leakage via Cross-Site Frame Counting in VS-Codespaces
## CVE Details
- **CVE ID:** Not explicitly provided in context (often categorized under Side-Channel Leakage)
- **CVSS Score:** N/A (Estimated Medium: 4.3 - 5.8)
- **CWE:** CWE-200: Exposure of Sensitive Information to an Unauthorized Actor / CWE-203: Information Exposure Through Discrepancy
## Affected Systems
- **Products:** VS-Codespaces (GitHub Integration)
- **Versions:** Vulnerable prior to the fix implementation (Specific version numbers not provided)
- **Configurations:** Web-based integration of VS-Codespaces with GitHub private repositories.
## Vulnerability Description
The flaw utilizes a side-channel technique known as **Cross-Site Frame Counting**. When a browser loads a target URL from a third-party origin, the parent window can count the number of window references (iFrames) within the target page.
In VS-Codespaces, the application loaded a variable number of iFrames depending on the existence of a repository or a specific file:
- **0 iFrames:** The private repository does not exist.
- **1 iFrame:** Both the private repository and the specific file exist.
- **2 iFrames:** The private repository exists, but the specific file does not.
By monitoring these window references, an attacker can bypass the Same-Origin Policy (SOP) to infer the presence of private data without authorized access to the content itself.
## Exploitation
- **Status:** Proof of Concept (PoC) available/validated by researcher.
- **Complexity:** Low (Requires a user to visit an attacker-controlled website).
- **Attack Vector:** Network (Web-based/Cross-site).
## Impact
- **Confidentiality:** Partial (Leaks the existence of private repositories and file structures).
- **Integrity:** None.
- **Availability:** None.
## Remediation
### Patches
- **Status:** Fixed by the vendor.
- **Action:** The vendor updated the application to ensure a **consistent number of iFrames** are loaded regardless of the repository or file state, eliminating the observable discrepancy.
### Workarounds
- Users can utilize modern browser features such as "Strict" Enhanced Tracking Protection or Privacy Badger, which may mitigate cross-site window reference counting in some scenarios.
- Organizations can enforce restricted access to Codespaces via IP allow-listing where applicable.
## Detection
- **Indicators of Compromise:** Unusual navigation patterns where a third-party site rapidly sets `win.location` to various GitHub/Codespaces paths in a hidden window or background tab.
- **Detection Methods:** This is difficult to detect at the network level as it occurs within the client's browser. Security headers like `Cross-Origin-Resource-Policy` (CORP) and `Cross-Origin-Opener-Policy` (COOP) can be audited to prevent these types of side-channels.
## References
- **Vendor Advisory:** GitHub/Microsoft Security Bulletins (Internal fix)
- **Resource:** hxxps[://]browser[.]engineering/privacy[.]html (Information on side-channel leaks)
- **Researcher Notes:** Reference to VS-Codespaces integration testing regarding iFrame counting discrepancies.