CVE-2022-36633 Improper token validation leading to code execution in Teleport

What is CVE-2022-36633?

CVE-2022-36633 is a high-severity command injection vulnerability in n/a, published on 24 Aug 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.

Weakness: CWE-78

Which versions are affected by CVE-2022-36633?

6 open source packages ship an affected version, including github.com/gravitational/teleport. It affects 1 product.

Products include Goteleport Teleport.

How do I fix CVE-2022-36633?

Upgrade github.com/gravitational/teleport to a fixed version for your release line: 8.3.17, 10.1.2 or 9.3.13.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-36633 being exploited?

There is no known exploitation of CVE-2022-36633 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2021-41393 Security feature bypass in n/a Critical 9.8
• CVE-2022-38599 Information disclosure in n/a Medium 6.5
• CVE-2021-41395 Other in n/a Medium 6.5
• CVE-2021-41394 Supply chain in n/a Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6xf3-5hp7-xqqg.