GitHub Enterprise Server Command Injection Vulnerability

CVE-2024-1355

Summary

A command injection vulnerability has been identified in GitHub Enterprise Server that poses significant security risks. Attackers with an editor role in the Management Console can exploit this flaw to gain unauthorized admin SSH access to the appliance via the actions-console docker container while setting a service URL. This vulnerability requires access to the GitHub Enterprise Server instance as well as permission within the Management Console. All versions of GitHub Enterprise Server prior to 3.12 are affected, with security patches provided in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. The vulnerability was reported through the GitHub Bug Bounty program.

References