Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

CVE-2024-2443

Summary

A command injection vulnerability exists in GitHub Enterprise Server, which could potentially allow an attacker with an editor role in the Management Console to obtain unauthorized admin SSH access to the server. This risk arises when configuring GeoJSON settings, requiring an attacker to have access to the GitHub Enterprise Server instance and to the Management Console with the editor role. This vulnerability impacts all versions of GitHub Enterprise Server prior to 3.13, and the issue has been addressed in versions 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. It was reported through the GitHub Bug Bounty program.

References