CVE-2022-23642highCWE-94

CVE-2022-23642: falha de alta gravidade em sourcegraph

Code Injection in Sourcegraph

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar sourcegraph

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

78Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.8epss 74%
da publicação à arma112 dias
Publicada no NVD18 de fev.
1ª PoC+112d
metasploit18 de fev.
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
sourcegraph · sourcegraph
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — sourcegraph

No mesmo produto, das mais perigosas para as menos.

CVE-2022-41942HIGHSourcegraph vulnerable to Comand Injection via gitserverEPSS 2.8%CVE-2022-41943CRITICALIncorrect default permissions found in SourcegraphEPSS 1.8%CVE-2022-29171MEDIUMRemote Code Execution in sourcegraphEPSS 1.4%CVE-2021-43823MEDIUMSide-channel attack in SourcegraphEPSS 0.9%CVE-2022-23643MEDIUMSide-channel attack in Sourcegraph Code MonitorsEPSS 0.8%CVE-2021-32787LOWLow risk information disclosure in SourcegraphEPSS 0.6%