Exploitation Summary
EIP tracks 3 public exploits for CVE-2022-23642.
PoCs published by Altelus, Altelus1, Altelus1, Spencer McIntyre, including Metasploit module exploits/linux/http/sourcegraph_gitserver_sshcmd.
AI-analyzed exploit summary This exploit leverages CVE-2022-23642 to achieve RCE on Sourcegraph Gitserver by abusing the lack of restriction on git config execution, allowing arbitrary command injection via the 'core.sshCommand' parameter. The exploit triggers command execution by setting a malicious SSH command and then invoking a git push operation.
Description
Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.
Exploits (3)
This exploit leverages CVE-2022-23642 to achieve RCE on Sourcegraph Gitserver by abusing the lack of restriction on git config execution, allowing arbitrary command injection via the 'core.sshCommand' parameter. The exploit triggers command execution by setting a malicious SSH command and then invoking a git push operation.
This PoC exploits CVE-2022-23642 in Sourcegraph Gitserver < 3.37.0 by abusing the 'core.sshCommand' git config to achieve remote code execution. It sends crafted HTTP requests to set the malicious config and trigger execution via a git push operation.
This Metasploit module exploits CVE-2022-23642 in Sourcegraph's gitserver by manipulating the `core.sshCommand` git configuration to achieve remote code execution. It automates the process of identifying cloned repositories, setting the malicious configuration, and triggering execution via a git push operation.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H