CVE-2022-23642

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.

• CWE-94
• CWE-862

• http://packetstormsecurity.com/files/167506/Sourcegraph-Gitserver-3.36.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/167741/Sourcegraph-gitserver-sshCommand-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/sourcegraph/sourcegraph/pull/30833Patch, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9Patch, Third Party Advisory
• http://packetstormsecurity.com/files/167506/Sourcegraph-Gitserver-3.36.3-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/167741/Sourcegraph-gitserver-sshCommand-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/sourcegraph/sourcegraph/pull/30833Patch, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9Patch, Third Party Advisory

Published

Feb 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23637K-Box is a web-based application to manage documents, images…5.4
• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1
• CVE-2022-23639crossbeam-utils provides atomics, synchronization primitives…8.1
• CVE-2022-2364A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8
• CVE-2022-23641Discourse is an open source discussion platform. In versions…6.5
• CVE-2022-23643Sourcegraph is a code search and navigation engine. Sourcegr…6.5
• CVE-2022-23644BookWyrm is a decentralized social network for tracking read…8.8
• CVE-2022-23645swtpm is a libtpms-based TPM emulator with socket, character…5.5
• CVE-2022-23646Next.js is a React framework. Starting with version 10.0.0 a…7.5
• CVE-2022-23647Prism is a syntax highlighting library. Starting with versio…6.1
• CVE-2022-23648containerd is a container runtime available as a daemon for …7.5