CVE-2024-2443

An attacker with editor role in the Management Console can inject malicious system commands while configuring GeoJSON settings. Lack of proper input validation (CWE-20) causes injected commands to be executed with system privileges, leading to obtaining administrative SSH access to the GitHub Enterprise Server instance. The attack is possible remotely without user interaction, but requires possession of an account with editor role in the Management Console.

An attacker can gain full administrative access (root SSH) to a GitHub Enterprise Server instance, enabling them to take control of the entire environment, including code repositories, user data, and system configuration.

GitHub Enterprise Server should be updated to version 3.8.17, 3.9.12, 3.10.9, 3.11.7, or 3.12.1 (accordingly for the used branch). Additionally, it is recommended to restrict access to the Management Console only to trusted users and to audit accounts with the editor role.

All GitHub Enterprise Server versions prior to 3.13, including branches 3.8, 3.9, 3.10, 3.11, and 3.12.