CVE-2022-23642: Code Injection
First published: Fri Feb 18 2022(Updated: )
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sourcegraph Sourcegraph | <3.37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/167506/Sourcegraph-Gitserver-3.36.3-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167741/Sourcegraph-gitserver-sshCommand-Remote-Command-Execution.html
- https://github.com/sourcegraph/sourcegraph/pull/30833
- https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9
Frequently Asked Questions
What is CVE-2022-23642?
CVE-2022-23642 is a vulnerability that affects Sourcegraph, a code search and navigation engine, prior to version 3.37.
What is the severity of CVE-2022-23642?
CVE-2022-23642 has a severity rating of 8.8, which is considered high.
How does CVE-2022-23642 affect Sourcegraph?
CVE-2022-23642 allows for remote code execution in the `gitserver` service of Sourcegraph.
How can an attacker exploit CVE-2022-23642?
An attacker can exploit CVE-2022-23642 by setting the git `core.sshCommand` to execute arbitrary commands.
How can I fix CVE-2022-23642?
To fix CVE-2022-23642, update Sourcegraph to version 3.37 or above.
- collector/nvd-index
- vendor/sourcegraph
- canonical/sourcegraph sourcegraph