PT-2022-16155 · Sourcegraph · Sourcegraph

Published 2022-02-15 · Updated 2022-02-24 · CVE-2022-23643

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sourcegraph versions 3.35 through 3.36.2

Description The issue is related to a side-channel vulnerability in the Code Monitoring feature, where strings in private source code could be guessed by an authenticated but unauthorized actor. A successful attack would require creating many Code Monitors to receive confirmation that a specific string exists, potentially allowing an attacker to guess formatted tokens in source code, such as API keys.

Recommendations For Sourcegraph versions 3.35 through 3.36.2, update to version 3.35.2 or 3.36.3 to resolve the issue. As a temporary workaround for those unable to upgrade, consider disabling the Code Monitor feature in the installation.

Exploit

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

CVE-2022-23643

GHSA-XQV2-X6F2-W3PF

Affected Products

Sourcegraph

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23643.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-23643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23643 · Security Note
• ❌ https://github.com/sourcegraph/sourcegraph/pull/30547 · Patch, Deleted
• https://t.me/cibsecurity/37545 · Telegram Post
• ❌ https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-xqv2-x6f2-w3pf · Note, Deleted