Impact
Sourcegraph is vulnerable to RCE in the gitserver service. The service acts as a git exec proxy, and failed to properly restrict calling git config. This allows an attacker set the git core.sshCommand option, which sets git to use the specified command instead of ssh when they need to connect to a remote system.
Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it.
Patches
This issue is patched in Sourcegraph version 3.37.
Workarounds
Ensuring that requests to gitserver are properly protected (for example using Kubernetes network policies). It is strongly recommended to upgrade the application to get a definitive patch.
References
For more information
Impact
Sourcegraph is vulnerable to RCE in the gitserver service. The service acts as a git exec proxy, and failed to properly restrict calling
git config. This allows an attacker set the gitcore.sshCommandoption, which sets git to use the specified command instead of ssh when they need to connect to a remote system.Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it.
Patches
This issue is patched in Sourcegraph version 3.37.
Workarounds
Ensuring that requests to gitserver are properly protected (for example using Kubernetes network policies). It is strongly recommended to upgrade the application to get a definitive patch.
References
For more information