PT-2024-20393 · Github · Github Enterprise Server

R31N · Published 2024-03-20 · Updated 2024-03-21 · CVE-2024-2443

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.13 GitHub Enterprise Server versions 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1 are not affected as they contain the fix, so the correct range is: GitHub Enterprise Server versions prior to 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1 are affected, but to simplify: GitHub Enterprise Server versions prior to 3.13

Description A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability was reported via the GitHub Bug Bounty program.

Recommendations For GitHub Enterprise Server versions prior to 3.8.17, update to version 3.8.17. For GitHub Enterprise Server versions 3.8.x and prior to 3.9.12, update to version 3.9.12. For GitHub Enterprise Server versions 3.9.x and prior to 3.10.9, update to version 3.10.9. For GitHub Enterprise Server versions 3.10.x and prior to 3.11.7, update to version 3.11.7. For GitHub Enterprise Server versions 3.11.x and prior to 3.12.1, update to version 3.12.1. For GitHub Enterprise Server versions 3.12.x and prior to 3.13, update to version 3.13 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-2443

Affected Products

Github Enterprise Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-2443 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2443 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.9 · Note
• https://twitter.com/cracbot/status/1770899653816455616 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.1 · Note
• https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.7 · Note
• https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.12 · Note
• https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.17 · Note
• https://t.me/cvenotify/74316 · Telegram Post