CVE-2022-29171

CVE-2022-29171 is a Remote Code Execution (RCE) vulnerability affecting Sourcegraph versions prior to 3.38.0, specifically within the gitserver service when using the Gitolite code host integration with Phabricator. This vulnerability allows a highly privileged attacker to execute arbitrary commands remotely, gaining direct access to the underlying Sourcegraph infrastructure. The vulnerability has a CVSS score of 7.2 (HIGH), indicating a severe impact with high confidentiality, integrity, and availability compromise. Exploitation requires site-admin privileges on Sourcegraph, administrative access to the bundled Grafana instance, and knowledge of the gitserver IP address, making it a high-privilege, low-complexity attack. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. Organizations are strongly encouraged to upgrade to version 3.38.0 or later, or disable Gitolite code hosts as a workaround.