PT-2019-8302 · Github · Github Enterprise

Published 2019-03-28 · Updated 2019-03-29 · CVE-2017-18365

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise versions 2.8.x through 2.8.6

Description The issue allows unauthenticated remote attackers to execute arbitrary code due to a deserialization problem in the Management Console. This occurs because the enterprise session secret is static and publicly accessible within the product's source code. An attacker can exploit this by sending a crafted cookie signed with the secret, enabling them to call Marshal.load with arbitrary data. The Marshal data format's ability to handle Ruby objects exacerbates this problem.

Recommendations For GitHub Enterprise versions 2.8.x through 2.8.6, update to version 2.8.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the Management Console to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-18365

Affected Products

Github Enterprise

References · 4

• 🔥 https://exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-18365 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18365 · Vendor Advisory
• https://enterprise.github.com/releases/2.8.7/notes · Vendor Advisory