GitHub Enterprise Server Vulnerability: Information Disclosure through Phishing

CVE-2024-9539

Summary

An information disclosure vulnerability exists in GitHub Enterprise Server that allows an attacker to exploit uploaded asset URLs to retrieve user metadata. By leveraging malicious SVG files, the attacker can craft a convincing phishing scheme, which relies on a victim user clicking an asset URL that the attacker has uploaded. This vulnerability impacts all versions of GitHub Enterprise Server before 3.14 and was mitigated in subsequent patches. The issue was reported through the GitHub Bug Bounty program, highlighting the importance of prompt updates and secure coding practices.

References