Command Injection Vulnerability in GitHub Enterprise Server Could Lead to Admin SSH Access

CVE-2024-1378

Summary

A command injection vulnerability exists within GitHub Enterprise Server, specifically affecting users with editor roles in the Management Console. This vulnerability allows an attacker to manipulate nomad templates during the configuration of SMTP options, ultimately leading to unauthorized admin SSH access to the appliance. It is critical for users to upgrade to the fixed versions to safeguard against this exploit, which applies to all versions of GitHub Enterprise Server prior to 3.12. The vulnerability was acknowledged through the GitHub Bug Bounty program.

References