{"id":"GHSA-6xf3-5hp7-xqqg","summary":"Improper token validation leading to code execution in Teleport","details":"Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.","aliases":["CVE-2022-36633"],"modified":"2026-08-07T08:12:02.121526161Z","published":"2022-08-25T00:00:28Z","database_specific":{"cwe_ids":["CWE-20","CWE-77"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-08-30T20:53:54Z","nvd_published_at":"2022-08-24T13:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36633"},{"type":"WEB","url":"https://github.com/gravitational/teleport/pull/14726"},{"type":"WEB","url":"https://github.com/gravitational/teleport/pull/14726/commits/46c23b9b64b944d1e82d2c8a79083f291ffdd3b6"},{"type":"PACKAGE","url":"https://github.com/gravitational/teleport"},{"type":"WEB","url":"https://github.com/gravitational/teleport/releases/tag/v10.1.2"},{"type":"WEB","url":"https://github.com/gravitational/teleport/releases/tag/v8.3.17"},{"type":"WEB","url":"https://github.com/gravitational/teleport/releases/tag/v9.3.13"},{"type":"WEB","url":"https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html"},{"type":"WEB","url":"http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html"}],"affected":[{"package":{"name":"github.com/gravitational/teleport","ecosystem":"Go","purl":"pkg:golang/github.com/gravitational/teleport"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.3.17"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-6xf3-5hp7-xqqg/GHSA-6xf3-5hp7-xqqg.json"}},{"package":{"name":"github.com/gravitational/teleport","ecosystem":"Go","purl":"pkg:golang/github.com/gravitational/teleport"},"ranges":[{"type":"SEMVER","events":[{"introduced":"9.0.0"},{"fixed":"9.3.13"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-6xf3-5hp7-xqqg/GHSA-6xf3-5hp7-xqqg.json"}},{"package":{"name":"github.com/gravitational/teleport","ecosystem":"Go","purl":"pkg:golang/github.com/gravitational/teleport"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.1.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-6xf3-5hp7-xqqg/GHSA-6xf3-5hp7-xqqg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}