Skip to content
This repository has been archived by the owner on Sep 30, 2024. It is now read-only.

Remote Code Execution in gitserver

High
andreeleuterio published GHSA-qcmp-fx72-q8q9 Feb 18, 2022

Package

gomod Sourcegraph (Go)

Affected versions

< 3.37

Patched versions

3.37

Description

Impact

Sourcegraph is vulnerable to RCE in the gitserver service. The service acts as a git exec proxy, and failed to properly restrict calling git config. This allows an attacker set the git core.sshCommand option, which sets git to use the specified command instead of ssh when they need to connect to a remote system.

Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it.

Patches

This issue is patched in Sourcegraph version 3.37.

Workarounds

Ensuring that requests to gitserver are properly protected (for example using Kubernetes network policies). It is strongly recommended to upgrade the application to get a definitive patch.

References

For more information

Severity

High

CVE ID

CVE-2022-23642

Weaknesses