R31N

A privilege escalation issue exists in the inter-process communication between the console and the protection service. A local, low-privileged authenticated user can execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service via the console-service channel.

An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

A Server-Side Request Forgery (SSRF) issue exists where the secret scanning validator for GCP service account credentials trusts the token endpoint embedded in a committed credential and issues a request to it without restricting the destination. This allows a repository contributor to force the appliance to send requests to internal hosts controlled by an attacker, which could be chained to achieve remote code execution. Exploitation requires an authenticated user with permissions to push to a repository on an instance where GitHub Advanced Security and secret scanning validity checks are enabled.

A server-side request forgery (SSRF) issue exists in the notebook viewer. While the system validates the scheme and host of a user-supplied URL, it fails to validate the port. This allows requests to be directed to internal services listening on different ports of the same appliance. Although response bodies are not returned, response timing serves as an oracle, enabling the character-by-character extraction of instance secrets. These secrets can subsequently be used in interactions with internal services to achieve remote code execution (RCE) on the appliance. Exploitation requires network access and is unauthenticated if private mode is disabled, or requires any authenticated user if private mode is enabled.

A Server-Side Request Forgery (SSRF) issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the redirection of trusted internal requests to a privileged service, resulting in remote code execution on the instance. Exploitation requires pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository with a configured pre-receive hook.

A path traversal issue allows a remote, unauthenticated attacker located on an adjacent network to execute arbitrary code on the system. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

A path traversal issue allows an unauthenticated attacker with network reachability to delete arbitrary files and directories on the instance, including the user storage directory containing Git LFS objects, release assets, attachments, and avatars. This occurs because the `X-GitHub-Request-Id` request header is used without sanitization as a filesystem path segment for the upload buffer directory. A traversal value can point the buffer to an arbitrary path, which is then recursively removed by the deferred cleanup routine. This issue persists even when private mode is enabled.

A Server-Side Request Forgery (SSRF) allows an attacker to force the server to send HTTP requests to internal services through the security advisories package lookup feature. By targeting an internal management service and analyzing response timing, an attacker can infer sensitive environment variables, such as private keys and signing secrets. This issue requires GitHub Packages to be enabled. On instances not operating in private mode, the flaw is exploitable without authentication; otherwise, it requires an authenticated user.

A server-side request forgery (SSRF) issue exists in the notebook viewer. This occurs due to URL parser confusion between the validation layer and the HTTP request library, where the hostname validation uses a different parser than the request library. This allows a crafted URL to bypass validation and direct requests to unintended internal services. Exploitation requires network access to the instance.

A server-side request forgery (SSRF) allows an attacker to extract sensitive environment variables from an instance via a timing side-channel attack against the notebook rendering service. When private mode is disabled, the notebook viewer follows HTTP redirects without revalidating the destination host, enabling unauthenticated SSRF to internal services. By chaining the instance's open redirect endpoint through an external redirect to reach internal services and using regex filter queries against an internal API to measure response time differences, an attacker can infer secret values character by character.

An URL redirection issue exists in GitHub Enterprise Server. This flaw allows an attacker to control redirects, potentially exposing sensitive authorization tokens. Specifically, the `repository pages` API improperly handles HTTP redirects when retrieving artifact URLs, carrying over the authorization header which includes a JWT (JSON Web Token). An authenticated user could redirect these requests to a domain controlled by an attacker, leading to the theft of the Actions.ManageOrgs JWT. This stolen token could then be used for potential remote code execution. Exploitation requires access to the target GitHub Enterprise Server and the ability to exploit a redirect to an attacker-controlled domain.

An authorization flaw exists in GitHub Enterprise Server that could allow an attacker to merge a pull request into a repository without necessary push permissions. This is due to an authorization bypass in the `enable auto merge` mutation for pull requests. The issue requires the target repository to allow forking and relies on opening a pull request from a fork controlled by the attacker. Successful exploitation is limited to pull requests with a clean status and branches lacking branch protection rules.

A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as during a hot patch upgrade. This means the vulnerability is only exploitable during specific operational conditions, which limits the attack window. Exploitation required either site administrator permissions to enable and configure pre-receive hooks or a user with permissions to modify repositories containing pre-receive hooks where this functionality was already enabled.

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.10.17 GitHub Enterprise Server versions prior to 3.11.15 GitHub Enterprise Server versions prior to 3.12.9 GitHub Enterprise Server versions prior to 3.13.4 GitHub Enterprise Server versions prior to 3.14.1 Description: A Cross-Site Scripting (XSS) issue was identified in the repository transfer feature of GitHub Enterprise Server. This allows attackers to steal sensitive user information via social engineering. Recommendations: For versions prior to 3.10.17, update to version 3.10.17 or later. For versions prior to 3.11.15, update to version 3.11.15 or later. For versions prior to 3.12.9, update to version 3.12.9 or later. For versions prior to 3.13.4, update to version 3.13.4 or later. For versions prior to 3.14.1, update to version 3.14.1 or later.

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role.

A command injection issue was identified in GitHub Enterprise Server, allowing an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this issue required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This issue was reported via the GitHub Bug Bounty program.

A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability was reported via the GitHub Bug Bounty program.

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability was reported via the GitHub Bug Bounty program.

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring SAML settings. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role.