CVE-2024-6800

The issue concerns the XML signature verification mechanism (CWE-347 — improper cryptographic signature verification) during SAML authentication with identity providers using publicly available, signed XML federation metadata. An attacker with direct network access to the GHES instance can construct a modified SAML response that passes signature verification using the 'wrapping' technique — injecting malicious data around the signed XML element. As a result, the server accepts forged SAML assertions as authentic, allowing the creation or takeover of an account with the highest privileges.

An attacker can gain unauthorized access to a GitHub Enterprise Server instance with site administrator privileges without prior authentication, enabling full control over the environment, repositories, and user data.

GitHub Enterprise Server should be updated as soon as possible to one of the following patched versions: 3.13.3, 3.12.8, 3.11.14, or 3.10.16. If immediate patching is not possible, consider restricting network access to the GHES instance and temporarily disabling SAML authentication until the patch is deployed.

All versions of GitHub Enterprise Server prior to 3.14 using SAML authentication with identity providers that use publicly available XML federation metadata.