Pierluigi Paganini August 22, 2024

GitHub addressed three vulnerabilities in its GitHub Enterprise Server product, including a critical authentication flaw.

GitHub addressed three security vulnerabilities impacting the GitHub Enterprise Server (GHES), including a critical flaw tracked as CVE-2024-6800 (CVSS score of 9.5). An attacker can trigger the vulnerability to gain site administrator privileges.

The vulnerability resides in the GHES’s SAML authentication and allows attackers with network access to forge SAML responses, potentially granting unauthorized site administrator access without prior authentication.

“On GitHub Enterprise Server instances that use SAML single sign-on (SSO) authentication with specific IdPs utilizing publicly exposed signed federation metadata XML, an attacker could forge a SAML response to provision and/or gain access to a user account with site administrator privileges. GitHub has requested CVE ID CVE-2024-6800 for this vulnerability, which was reported via the GitHub Bug Bounty program.” reads the advisory.

This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14. GitHub addressed the flaw in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. The vulnerability was reported via the GitHub Bug Bounty program.

The other issues addressed by the company are two medium-severity vulnerabilities in GHES. The first flaw (CVE-2024-7711) allowed an attacker to modify issue details in public repositories. The second flaw (CVE-2024-6337) enabled an attacker to disclose issue contents from private repositories using a GitHub App with specific permissions. Both vulnerabilities were reported through GitHub’s Bug Bounty program.

GitHub Enterprise Server (GHES) is a self-hosted version of GitHub designed for use within organizations. It provides the full capabilities of GitHub, including source code management, version control, collaboration tools, and continuous integration and delivery (CI/CD), but allows organizations to host the platform on their own infrastructure. This setup is ideal for companies that require more control over their data, enhanced security, and customization to meet internal compliance and regulatory requirements.

In May, GitHub rolled out security fixes to address a critical authentication bypass issue, tracked as CVE-2024-4985 (CVSS score: 10.0), in the GHES.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, GHES)