Sourcegraph up to 3.40.x Saved Search authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in Sourcegraph up to 3.40.x. This affects an unknown function of the component Saved Search Handler. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2022-31155. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Sourcegraph up to 3.40.x. This vulnerability affects an unknown functionality of the component Saved Search Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. As an impact it is known to affect integrity, and availability. CVE summarizes:

Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended.

The weakness was shared 08/02/2022 as GHSA-37qp-9jq6-f6mx. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-31155 since 05/18/2022. There are neither technical details nor an exploit publicly available.

Upgrading to version 3.41.0 eliminates this vulnerability. Applying the patch 2832d7882396a6295ba5803b5ef48dc7d5a24c59 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Sourcegraph

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37
• 3.38
• 3.39
• 3.40

License

• open-source

Website

• Product: https://github.com/sourcegraph/sourcegraph/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion