CVE-2022-23642 Code Injection in Sourcegraph
Attackers can execute arbitrary code by manipulating git configuration via the gitserver service in Sourcegraph deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23642?
CVE-2022-23642 is a high-severity code injection vulnerability in sourcegraph, published on 18 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.
Which versions are affected by CVE-2022-23642?
It affects 1 product.
Products include Sourcegraph Sourcegraph.
How do I fix CVE-2022-23642?
No fix has been published for CVE-2022-23642 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-23642 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23642 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in sourcegraph
- CVE-2022-41943 Incorrect default permissions found in Sourcegraph
- CVE-2022-41942 Sourcegraph vulnerable to Comand Injection via gitserver
- CVE-2022-29171 Remote Code Execution in sourcegraph
- CVE-2022-23643 Side-channel attack in Sourcegraph Code Monitors
- CVE-2021-43823 Side-channel attack in Sourcegraph