PT-2022-3024 · Sourcegraph · Sourcegraph

Published 2022-02-10 · Updated 2023-06-27 · CVE-2022-23642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcegraph versions prior to 3.37

Description The issue is related to the gitserver service in Sourcegraph, which acts as a git exec proxy and fails to properly restrict calling git config. This allows an attacker to set the git core.sshCommand option, enabling them to execute arbitrary code by making HTTP requests to internal services like gitserver. The exploitation depends on how Sourcegraph is deployed.

Recommendations For versions prior to 3.37, update to version 3.37 to resolve the issue. As a temporary workaround, ensure that requests to gitserver are properly protected.

Exploit

Fix

Missing Authorization

Code Injection

Weakness Enumeration

CWE-862

CWE-94

Related Identifiers

BDU:2022-03690

CVE-2022-23642

GHSA-QCMP-FX72-Q8Q9

Affected Products

Sourcegraph

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23642.json · Exploit
• 🔥 https://github.com/Altelus1/CVE-2022-23642 · Exploit
• 🔥 http://packetstormsecurity.com/files/167741/Sourcegraph-gitserver-sshCommand-Remote-Command-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/167506/Sourcegraph-Gitserver-3.36.3-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50964 · Exploit
• ❌ https://github.com/sourcegraph/sourcegraph/pull/30833 · Patch, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-23642 · Security Note
• ❌ https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9 · Patch, Deleted
• https://bdu.fstec.ru/vul/2022-03690 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23642 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/6186 · Telegram Post
• https://t.me/cvenotify/33003 · Telegram Post
• https://t.me/cibsecurity/37810 · Telegram Post
• https://t.me/cvenotify/27831 · Telegram Post