CVE-2022-23643 - Side-channel attack in Sourcegraph Code Monitors

Back Back to CVE browser

MEDIUM

Side-channel attack in Sourcegraph Code Monitors

Published Feb 15, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.80%

Description

Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code Monitoring feature where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue affects only the Code Monitoring feature, whereas CVE-2021-43823 also affected saved searches. A successful attack would require an authenticated bad actor to create many Code Monitors to receive confirmation that a specific string exists. This could allow an attacker to guess formatted tokens in source code, such as API keys. This issue was patched in versions 3.35.2 and 3.36.3 of Sourcegraph. Those who are unable to upgrade may disable the Code Monitor feature in their installation.

Affected products

Vendor Sourcegraph Product Sourcegraph Default
n/a
- Version
  >= 3.35, < 3.35.2
  Status
  affected
  Constraints
  -
- Version
  >= 3.36, < 3.36.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sourcegraph

n/a

Version	Status	Constraints
>= 3.35, < 3.35.2	affected	-
>= 3.36, < 3.36.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-203

References (2)

https://github.com/sourcegraph/sourcegraph/pull/30547
x_refsource_MISCPatchThird Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-xqv2-x6f2-w3pf
x_refsource_CONFIRMIssue TrackingThird Party Advisory

Link	Providers	Tags
https://github.com/sourcegraph/sourcegraph/pull/30547		x_refsource_MISCPatchThird Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-xqv2-x6f2-w3pf		x_refsource_CONFIRMIssue TrackingThird Party Advisory