CVE-2022-41942
HIGH severity · CVSS 7.9 · Improper input validation
7.9CVSS HIGH
Summary
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the `/list-gitolite` endpoint. It was possible to send a crafted request to gitserver that would execute commands inside the container. Successful exploitation requires the ability to send local requests to gitserver. The issue is patched in version 4.1.0.
Impact & exploitability
Attack vectorAdjacent
Attack complexityHigh
Privileges requiredLow
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactLow
Exploit probability (EPSS)2%
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: https://github.com/sourcegraph/sourcegraph/pull/42553 ↗