{"vulnerability": "CVE-2022-23642", "sightings": [{"uuid": "fcf1f073-06f3-4d97-af9e-2bb3089ef97b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "4203c863-8b8c-4f7d-87d8-eebb9f2930cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:44.000000Z"}, {"uuid": "8311c476-fd8f-4ee4-8cb9-9341cda670eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb", "content": "", "creation_timestamp": "2022-07-13T14:37:15.000000Z"}, {"uuid": "1a5c4ad2-c340-47dd-b5cd-f1bd261f0c0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "published-proof-of-concept", "source": "Telegram/Ip3Gh0poW8tdMG07iwidHvLEgfZ4cxE7wfqyPu63vqdGfw", "content": "", "creation_timestamp": "2022-06-13T03:23:07.000000Z"}, {"uuid": "faba4eba-2529-4542-b86a-4ced242d31ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "published-proof-of-concept", "source": "https://t.me/MrVGunz/218", "content": "CVE-2022-23642 : Sourcegraph Gitserver < 3.37 RCE\nhttps://github.com/Altelus1/CVE-2022-23642", "creation_timestamp": "2022-06-12T23:09:17.000000Z"}, {"uuid": "112a7c36-bad9-4953-a5c2-2e49b24449ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "published-proof-of-concept", "source": "https://t.me/crackcodes/685", "content": "\u200bCVE-2022-23642\n\nPoC for Sourcegraph Gitserver 3.37.0 RCE\n\nSourcegraph prior to 3.37.0 has a remote code execution vulnerability on its gitserver service. This is due to lack of restriction on git config execution thus \"core.sshCommand\" can be passed on the HTTP arguments which can contain arbitrary bash commands. Note that this is only possible if gitserver is exposed to the attacker.\n\nhttps://github.com/Altelus1/CVE-2022-23642\n\nResearch:\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23642\n\n#exploit #cve", "creation_timestamp": "2022-06-13T03:16:30.000000Z"}, {"uuid": "bf784d0b-98e0-4244-bee3-c25489578a59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "seen", "source": "https://t.me/cibsecurity/37810", "content": "\u203c CVE-2022-23642 \u203c\n\nSourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy, and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option, which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround, ensure that requests to gitserver are properly protected.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-19T02:38:45.000000Z"}, {"uuid": "f7944e9f-0e66-44b2-8ca3-0cd3be3d0d01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/6186", "content": "#exploit\n1. CVE-2022-23642:\nPoC for Sourcegraph Gitserver < 3.37 RCE\nhttps://github.com/Altelus1/CVE-2022-23642\n\n2. CVE-2022-24806/CVE-2022-24807:\nUnauthenticated RCE vulnerability in Magento and Adobe Commerce\nhttps://github.com/oturu/CVE-2022-24806-MASS-RCE", "creation_timestamp": "2022-06-12T13:48:14.000000Z"}, {"uuid": "4beb8d85-cf44-44dd-b0e5-65ff00d05e01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23642", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Altelus1\", \"Spencer McIntyre\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"A vulnerability exists within Sourcegraph's gitserver component that allows a remote attacker to execute\\n          arbitrary OS commands by modifying the core.sshCommand value within the git configuration. This command can\\n          then be triggered on demand by executing a git push operation. The vulnerability was patched by introducing a\\n          feature flag in version 3.37.0. This flag must be enabled for the protections to be in place which filter the\\n          commands that are able to be executed through the git exec REST API.\", \"disclosure_date\": \"2022-02-18\", \"fullname\": \"exploit/linux/http/sourcegraph_gitserver_sshcmd\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"Sourcegraph gitserver sshCommand RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/sourcegraph_gitserver_sshcmd\", \"references\": [\"CVE-2022-23642\", \"URL-http://web.archive.org/web/20230705082819/https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9\", \"URL-https://github.com/Altelus1/CVE-2022-23642\"], \"rport\": 3178, \"session_types\": false, \"targets\": [\"Automatic\", \"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:56.251264Z"}]}