Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-36633

CVE-2022-36633: Improper token validation leading to code execution in Teleport

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-36633
GHSA ID
GHSA-6xf3-5hp7-xqqg
EPSS Score
0.97041%
CWE
CWE-20
Published
8/25/2022
Updated
8/8/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/gravitational/teleportgo< 8.3.178.3.17
github.com/gravitational/teleportgo>= 9.0.0, < 9.3.139.3.13
github.com/gravitational/teleportgo>= 10.0.0, < 10.1.210.1.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper validation in the node join script generation endpoint. Analysis of the patch (PR #14726) shows the critical fix was adding backend token validation in getJoinScript(). Pre-patch versions would accept any hex-encoded token without verifying its legitimacy, enabling command injection via carriage return/line feed escapes in the token parameter. The function's direct use of untrusted input in script generation without validation matches the CWE-20 and CWE-77 descriptions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T*l*port *.*.* is vuln*r**l* to *omm*n* inj**tion l***in* to R*mot* *o** *x**ution. *n *tt**k*r **n *r**t * m*li*ious ss* ***nt inst*ll*tion link *y URL *n*o*in* * **s* *s**p* wit* **rri*** r*turn lin* ****. T*is url *n*o*** p*ylo** **n ** us** in pl

Reasoning

T** vuln*r**ility st*mm** *rom improp*r `v*li**tion` in t** no** join s*ript **n*r*tion *n*point. *n*lysis o* t** p*t** (PR #*****) s*ows t** *riti**l *ix w*s ***in* ***k*n* tok*n `v*li**tion` in `**tJoinS*ript()`. Pr*-p*t** v*rsions woul* ****pt *ny