PT-2022-19428 · Grafana+2 · Grafana+2

Published 2022-05-05 · Updated 2023-07-21 · CVE-2022-29171

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcegraph versions prior to 3.38.0

Description The issue concerns Remote Code Execution in the gitserver service of Sourcegraph, a fast and featureful code search and navigation engine. The Gitolite code host integration with Phabricator allows Sourcegraph site admins to specify a callsignCommand, which can be changed arbitrarily and run remotely by an administrator with site-admin privileges and administrative access to the bundled Grafana instance. This grants direct access to the infrastructure underlying the Sourcegraph installation. The attack requires site-admin privileges on the instance of Sourcegraph, administrative privileges on the bundled Grafana monitoring instance, and knowledge of the gitserver IP address or DNS name.

Recommendations For versions prior to 3.38.0, upgrade to version 3.38.0 to resolve the issue. As a temporary workaround, consider disabling Gitolite code hosts until the issue is resolved.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2022-29171

GHSA-R2M9-HFG8-4C38

Affected Products

Grafana

Phabricator

Sourcegraph

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29171.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29171 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29171 · Vendor Advisory
• ❌ https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-r2m9-hfg8-4c38 · Note, Deleted
• https://t.me/cvenotify/29777 · Telegram Post
• https://t.me/cibsecurity/42081 · Telegram Post