A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collectd configurations. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program https://bounty.github.com .
The vulnerability results from insufficient input validation (CWE-20) in the collectd service configuration in the Management Console. An attacker with the editor role can inject malicious system commands (CWE-77) through the username or password fields in the collectd configuration. As a result, it is possible to obtain SSH access with administrator privileges to the entire GitHub Enterprise Server instance.
An attacker can gain full administrative access (admin SSH) to a GitHub Enterprise Server instance, enabling server takeover, access to stored repositories, and user data.
GitHub Enterprise Server should be updated to version 3.11.5, 3.10.7, 3.9.10, or 3.8.15 (depending on the branch in use). Additionally, it is recommended to restrict access to the Management Console to trusted users only and to regularly review assigned roles, particularly the editor role.
All versions of GitHub Enterprise Server before 3.12, including branches 3.8.x, 3.9.x, 3.10.x, and 3.11.x.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HGitHub Enterprise Server
APPGithub< 3.8.153.9.0 – 3.9.10 (excl.)3.10.0 – 3.10.7 (excl.)3.11.0 – 3.11.5 (excl.)
Related vulnerabilities
SSRF z path traversal w GitHub Enterprise Server — dostęp do wewnętrznych usług
Obejście uwierzytelniania SAML SSO w GitHub Enterprise Server
XML Signature Wrapping w GitHub Enterprise Server — fałszowanie SAML
Authentication bypass w GitHub Enterprise Server via SAML SSO
Command injection w GitHub Enterprise Server — eskalacja do admina SSH