Attacking Language Server JSON RPC

While auditing a VSCode Extension + Language Server I noticed something interesting. This turned into the research question "can we attack the extension from the browser?". After a bit of preliminary research I decided to do it again on stream, and eventually made this video. This is how security research can look like. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Watch this video and more on Hextree: https://app.hextree.io/courses/yt-0da... Join the Hextree Discord:   / discord   What is a Server?    • What is a Server? (Deepdive)   What is a Protocol?    • What is a Protocol? (Deepdive)   GitLab 11.4.7 RCE    • GitLab 11.4.7 Remote Code Execution - Real...   Live Stream:    • Attacking VSCode Extension from Browser? -...   Interested in more videos like this?    • Security Research   CHAPTERS 00:00 - Why Security Research? 01:23 - What is a Language Server? 02:53 - Setup Example Code 04:00 - RCE in VSCode Extension? 05:25 - The Language Server Code 06:29 - Researching Communication 11:13 - Can a Browser Attack the VSCode Extension? 13:54 - Research Results 15:40 - Ad n' Outro SUPPORT Per video:   / liveoverflow   Per month:    / @liveoverflow   Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel:    / liveunderflow   Twitch:   / liveoverflow   Twitter:   / liveoverflow   Instagram:   / liveoverflow   TikTok:   / liveoverflow_   LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #SecurityResearch #VSCode #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.