PT-2021-15237 · Github · Github Enterprise Server
Yvvdwf
·
Published
2021-03-23
·
Updated
2023-06-30
·
CVE-2021-22864
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
GitHub Enterprise Server versions prior to 3.0.3
GitHub Enterprise Server version 2.22.9
GitHub Enterprise Server version 2.21.17
Description
A remote code execution issue was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted, making it possible to override environment variables leading to code execution on the GitHub Enterprise Server instance. To exploit this issue, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance.
Recommendations
For GitHub Enterprise Server versions prior to 3.0.3, update to version 3.0.3 or later.
For GitHub Enterprise Server version 2.22.9, no additional action is required as this version contains a fix for the issue.
For GitHub Enterprise Server version 2.21.17, no additional action is required as this version contains a fix for the issue.
As a temporary workaround, consider restricting access to GitHub Pages site creation and build permissions to minimize the risk of exploitation.
Fix
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Github Enterprise Server