Code Injection Vulnerability in GitHub Enterprise Server

CVE-2024-10001

Summary

A code injection vulnerability has been identified in GitHub Enterprise Server that permits attackers to inject malicious code through the identity property in message handling. This flaw can lead to the exfiltration of sensitive data, including authentication tokens, by manipulating the Document Object Model (DOM). To launch the attack, victims must be logged into GitHub and interact with a specially crafted webpage controlled by attackers, containing a hidden iframe. The vulnerability arises from improper validation sequences, where the origin check is conducted after accepting the user-controlled identity property. Affected versions include all GitHub Enterprise Server instances prior to the specified releases, prompting users to update to safer versions.

References