PT-2019-8302 · Github · Github Enterprise

Publicado 2019-03-28 · Atualizado 2019-03-29 · CVE-2017-18365

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise versions 2.8.x through 2.8.6

Description The issue allows unauthenticated remote attackers to execute arbitrary code due to a deserialization problem in the Management Console. This occurs because the enterprise session secret is static and publicly accessible within the product's source code. An attacker can exploit this by sending a crafted cookie signed with the secret, enabling them to call Marshal.load with arbitrary data. The Marshal data format's ability to handle Ruby objects exacerbates this problem.

Recommendations For GitHub Enterprise versions 2.8.x through 2.8.6, update to version 2.8.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the Management Console to minimize the risk of exploitation.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-18365

Produtos afetados

Github Enterprise

Referências · 4

• 🔥 https://exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18365 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-18365 · Aviso do Fabricante
• https://enterprise.github.com/releases/2.8.7/notes · Aviso do Fabricante