Command Injection Vulnerability in GitHub Enterprise Server Could Lead to Admin SSH Access

CVE-2024-1369

Summary

A command injection vulnerability was identified in GitHub Enterprise Server, allowing attackers with editor roles in the Management Console to execute malicious commands that could result in unauthorized admin SSH access to the appliance. This exploitation was contingent on the attacker having access to the GitHub Enterprise Server instance and the necessary permissions within the Management Console. The vulnerability impacts all versions of GitHub Enterprise Server prior to version 3.12. This issue has been remediated in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. It was reported through the GitHub Bug Bounty program, demonstrating the importance of community-sourced security vigilance.

References