GitHub Enterprise Server Command Injection Vulnerability

CVE-2024-1354

Summary

A vulnerability was identified in GitHub Enterprise Server that allows an attacker with an editor role in the Management Console to execute command injection through the manipulation of the syslog-ng configuration file. This exploitation enables unauthorized admin SSH access to the appliance. To exploit this vulnerability, the attacker must have access to the GitHub Enterprise Server instance and hold an editor's role within the Management Console. All versions of GitHub Enterprise Server prior to 3.12 are impacted. The issue has been resolved in the following versions: 3.11.5, 3.10.7, 3.9.10, and 3.8.15. Reporting and mitigation efforts were conducted via the GitHub Bug Bounty program.

References