Vulnerability · Published Aug 24, 2022 · Assigned by mitre

CVE-2022-36633

High 8.8

In plain English

A high-severity security flaw in the github.com/gravitational/teleport package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 50.3% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)50.3%top 1.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/gravitational/teleport	8.3.17	GHSA-6xf3-5hp7-xqqg
Go	github.com/gravitational/teleport	9.3.13	GHSA-6xf3-5hp7-xqqg
Go	github.com/gravitational/teleport	10.1.2	GHSA-6xf3-5hp7-xqqg

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gravitational/teleport x_refsource_MISC
https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html x_refsource_MISC
http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html x_refsource_MISC