CVE-2022-23642highCWE-94

CVE-2022-23642: high-severity vulnerability in sourcegraph

Code Injection in Sourcegraph

Published · Updated

Follow this CVE+ Monitor sourcegraph

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

78Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.8epss 74%
from disclosure to weapon112 days
Published on NVDFeb 18
1st PoC+112d
metasploitFeb 18
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
sourcegraph · sourcegraph
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sourcegraph

In the same product, most dangerous first.

CVE-2022-41942HIGHSourcegraph vulnerable to Comand Injection via gitserverEPSS 2.8%CVE-2022-41943CRITICALIncorrect default permissions found in SourcegraphEPSS 1.8%CVE-2022-29171MEDIUMRemote Code Execution in sourcegraphEPSS 1.4%CVE-2021-43823MEDIUMSide-channel attack in SourcegraphEPSS 0.9%CVE-2022-23643MEDIUMSide-channel attack in Sourcegraph Code MonitorsEPSS 0.8%CVE-2021-32787LOWLow risk information disclosure in SourcegraphEPSS 0.6%