CVE-2024-9487

The vulnerability lies in improper verification of cryptographic signature (CWE-347) in the SAML SSO mechanism. To carry out the attack, additional conditions must be met: encrypted assertions feature must be enabled on the instance, the attacker must have direct network access to the server, and must possess a signed SAML response or metadata document. Meeting these requirements allows the attacker to forge the authentication process and bypass access controls.

An attacker can unauthorized create user accounts (provisioning) and gain unauthorized access to GitHub Enterprise Server instance, including potentially code repositories and sensitive data stored in the system.

GitHub Enterprise Server should be updated to version 3.11.16, 3.12.10, 3.13.5, or 3.14.2 (depending on the branch in use). As an interim workaround, disabling the SAML encrypted assertions feature can be considered until the patch is deployed.

All versions of GitHub Enterprise Server older than 3.15 with the SAML encrypted assertions feature enabled.