CVE-2022-23642

Katalog CVE

CVSS 8.8 · High EPSS 74,3%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada sourcegraph. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.

Rincian

Terbit di NVD

18 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-862: Missing Authorization

EPSS (30 hari)

74,3% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sourcegraph/sourcegraph/pull/30833 patch · advisory pihak ketiga
• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9 patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/167506/Sourcegraph-Gitserver-3.36.3-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/167741/Sourcegraph-gitserver-sshCommand-Remote-Command-Execution.html exploit · advisory pihak ketiga · vdb entry