Command Injection Vulnerability in GitHub Enterprise Server Could Lead to Admin SSH Access

CVE-2024-1359

Summary

A command injection vulnerability in GitHub Enterprise Server has been identified, enabling an attacker with editor role permissions in the Management Console to execute malicious commands. This vulnerability arises specifically during the configuration of an HTTP proxy, potentially allowing unauthorized SSH access to the appliance. It is imperative for organizations leveraging GitHub Enterprise Server versions prior to 3.12 to apply updates, specifically versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15, which address this security flaw.

References