Skip to content
Fencer Intel
high 8.8

CVE-2022-36633 in the critical feed json

Improper token validation leading to code execution in Teleport

published 4y ago modified 3mo ago also GHSA-6xf3-5hp7-xqqg , EUVD-2022-6495

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
50.3%
EPSS 50.3% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.

Patch / fix

  • go github.com/gravitational/teleport 8.3.17, 9.3.13, 10.1.2
  • goteleport teleport 10.1.2

Is CVE-2022-36633 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. Published
  2. First public exploit (EDB-51019)

Exploit prediction

50.28% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-51019 Teleport v10.1.1 - Remote Code Execution (RCE) remote, 2022-09-23
  • packetstormsecurity.com https://packetstormsecurity.com/files/168137/Teleport-9.3.6-Command-Injection.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/168477/Teleport-10.1.1-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/gravitational/teleport
<8.3.17
>=9.0.0, <9.3.13
>=10.0.0, <10.1.2
8.3.17
9.3.13
10.1.2

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-20 Improper Input Validation
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.