// For flags

CVE-2022-23643

Side-channel attack in Sourcegraph Code Monitors

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code Monitoring feature where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects only the Code Monitoring feature, whereas CVE-2021-43823 also affected saved searches. A successful attack would require an authenticated bad actor to create many Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in versions 3.35.2 and 3.36.3 of Sourcegraph. Those who are unable to upgrade may disable the Code Monitor feature in their installation.

Sourcegraph es un motor de búsqueda y navegación de código. Sourcegraph versiones 3.35 y 3.36, reintrodujeron una vulnerabilidad de canal lateral previamente corregida en la funcionalidad Code Monitoring donde las cadenas en el código fuente privado podían ser adivinadas por un actor autenticado pero no autorizado. Este problema sólo afecta a la funcionalidad Code Monitoring, mientras que CVE-2021-43823 también afectaba a las búsquedas guardadas. Un ataque con éxito requeriría que un actor malicioso autenticado creara muchos Monitores de Código para recibir la confirmación de que una cadena específica se presenta. Esto podría permitir a un atacante adivinar los tokens formateados en el código fuente, como las claves de la API. Este problema fue parcheado en las versiones 3.35.2 y 3.36.3 de Sourcegraph. Aquellos que no puedan actualizarse pueden deshabilitar la funcionalidad Code Monitor en su instalación

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-19 CVE Reserved
  • 2022-02-15 CVE Published
  • 2023-09-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-203: Observable Discrepancy
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sourcegraph
Search vendor "Sourcegraph"
 Sourcegraph
Search vendor "Sourcegraph" for product "Sourcegraph"
 >= 3.35.0 < 3.35.2
Search vendor "Sourcegraph" for product "Sourcegraph" and version " >= 3.35.0 < 3.35.2"
-
Affected
Sourcegraph
Search vendor "Sourcegraph"
 Sourcegraph
Search vendor "Sourcegraph" for product "Sourcegraph"
 >= 3.36.0 < 3.36.3
Search vendor "Sourcegraph" for product "Sourcegraph" and version " >= 3.36.0 < 3.36.3"
-
Affected