This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Sourcegraph allows attackers to inject arbitrary commands via `git` config. <br>๐ฅ **Consequences**: Remote Code Execution (RCE). Attackers can run bash commands on the server.โฆ
๐ก๏ธ **Root Cause**: CWE-94 (Code Injection). <br>๐ **Flaw**: Lack of restriction on `git` config execution. The `core.sshCommand` option is not sanitized, allowing arbitrary bash commands to be passed via HTTP arguments.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: Sourcegraph **Gitserver** service. <br>๐ **Versions**: Prior to **v3.37.0** (e.g., v3.36.3). <br>๐ข **Vendor**: Sourcegraph Inc.
Q4What can hackers do? (Privileges/Data)
๐ **Privileges**: Full RCE on the gitserver host. <br>๐ **Data**: Complete compromise of the server. Attackers can read/write files, install backdoors, and pivot to other internal systems.
Q5Is exploitation threshold high? (Auth/Config)
โ ๏ธ **Threshold**: Medium. <br>๐ **Auth**: Requires **Low Privileges** (PR:L). <br>๐ **Config**: Attacker must be able to send HTTP requests to the internal `gitserver` service.โฆ
๐ **Exploit**: **Yes**. <br>๐ **PoC**: Publicly available on GitHub (Altelus1/CVE-2022-23642). <br>๐ **Status**: Tested on v3.36.3. PacketStorm links also exist.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: <br>1. Check Sourcegraph version (< 3.37.0). <br>2. Verify if `gitserver` is exposed to untrusted networks. <br>3. Scan for HTTP requests manipulating `core.sshCommand` in git configs.
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: **Yes**. <br>๐ฉน **Patch**: Upgrade to Sourcegraph **v3.37.0** or later. <br>๐ **Ref**: GitHub Advisory GHSA-qcmp-fx72-q8q9 and PR #30833.
Q9What if no patch? (Workaround)
๐ง **Workaround**: <br>1. **Isolate**: Ensure `gitserver` is **not** accessible from untrusted networks. <br>2. **Restrict**: Block HTTP requests to the gitserver endpoint from external IPs. <br>3.โฆ
๐ฅ **Urgency**: **HIGH**. <br>โก **Priority**: Immediate patching required if gitserver is exposed. CVSS Score is **High** (9.8). RCE risk is severe. Do not ignore!