Cursor's Remote Tunnel capability is vulnerable to malicious prompt injection

Threat Intel
, ,
1

The AI security firm Straiker has demonstrated a vulnerability in Cursor 2.x that allows a malicious prompt injection that has the potential to escape the sandbox provided by Cursor and take over the developer machine. There is little in the way of indicators of compromise for this vulnerability. It seems that simply checking out a Cursor library of prompts from a repository is enough to allow the injection to be executed.

1 Like
2

Two quick takeaways that I can see:

  1. The initial exploit is literally just classic command injection via chaining. cd ./ && do-some-evil works? Come onnnn
  2. I had no idea Cursor had its own tunneling capability

Oh wait—it’s just VS Code Remote Tunnels, aka Dev Tunnels!

These things are evil and should be banned imo. They’re very popular as a C2 mechanism.

You can block these by domain. Microsoft maintains a full list here:

That doesn’t stop the prompt injection attack, but it does mitigate a specific means of C2/session hijacking.

1 Like
3

Hey hey folks,

Just wanted to add to this, that “dev tunnels” is a whole thing ™, and there are a lot of apps that do this.

If you’re looking to enumerate usage of “Dev Tunnels” in your enterprise networks, I would advise taking a look at B’ad Samurai’s bs-lists github repo, specifically the LOTT (Living Off Trusted Tunnels) list.

I have stolen significantly borrowed from B’ad Samurai’s work, and have ensured that most, if not all of these domains over to the EmergingThreats ruleset as well. Detection for DNS queries and TLS SNI(Server Name Indicator) for many of these domains are available in the Emerging Threats Open ruleset for Snort and Suricata.

In relation to this article, and the link that @mttaggart provided, Here are SID numbers for Microsoft Dev Tunnel Domains in the ET ruleset:

2047820: Microsoft Dev Tunnels Domain DNS Lookup (devtunnels .ms)
2066086: Network Tunneling Service in DNS Lookup (rel .tunnels .api .visualstudio .com)
2066126: Observed Network Tunneling Service Domain (rel .tunnels .api .visualstudio .com) in TLS SNI
2063119: Microsoft Dev Tunnels Domain (tunnels .api .visualstudio .com) in DNS Lookup
2063120: Microsoft Dev Tunnels Domain (tunnels .api .visualstudio .com) in TLS SNI

Note: I noticed we didn’t have an SNI rule for devtunnels.ms, and I’ve taken the liberty of covering that today. expect a new rule for that in today’s daily rule release to land in the ETOPEN ruleset. Cheers.

4 Likes