PT-2022-26172 · Sourcegraph · Sourcegraph

Published 2022-11-22 · Updated 2022-11-26 · CVE-2022-41942

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Sourcegraph versions prior to 4.1.0

Description The issue is a command injection vulnerability in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the "/list-gitolite" endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver.

Recommendations For versions prior to 4.1.0, update to version 4.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/list-gitolite" endpoint to minimize the risk of exploitation. Avoid using the host parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2022-41942

GHSA-PFM3-23MH-6XJP

Affected Products

Sourcegraph

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41942.json · Exploit
• ❌ https://github.com/sourcegraph/sourcegraph/pull/42553 · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-41942 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41942 · Vendor Advisory
• https://t.me/cvenotify/38258 · Telegram Post
• ❌ https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-pfm3-23mh-6xjp · Note, Deleted
• https://t.me/cibsecurity/53373 · Telegram Post