PT-2024-35955 · Github+3 · Github Cli+3

Ry0Tak · Published 2024-11-27 · Updated 2026-02-04 · CVE-2024-53858

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: GitHub CLI versions prior to 2.63.0

Description: A security issue has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This issue stems from several gh commands, including gh repo clone, gh repo fork, and gh pr checkout, which invoke git with instructions to retrieve authentication tokens using the credential.helper configuration variable for any host encountered. Prior to version 2.63.0, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts, and tokens are sourced from environment variables GITHUB ENTERPRISE TOKEN, GH ENTERPRISE TOKEN, and GITHUB TOKEN when the CODESPACES environment variable is set. The result is git sending authentication tokens when cloning submodules. Successful exploitation could lead to a third-party using leaked authentication tokens to access privileged resources.

Recommendations: Upgrade to version 2.63.0 or later. Revoke authentication tokens used with the GitHub CLI, including personal access tokens and GitHub CLI OAuth app authorizations. Review your personal security log and any relevant audit logs for actions associated with your account or enterprise.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

AZL-53477

AZL-53759

CVE-2024-53858

GHSA-JWCM-9G39-PMCW

GO-2024-3296

OPENSUSE-SU-2024:14567-1

USN-8012-1

Affected Products

Debian

Github Cli

Linuxmint

Ubuntu

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53858.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53858 · Security Note
• https://ubuntu.com/security/CVE-2024-54132 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14567-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8012-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53858 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53858 · Security Note
• https://osv.dev/vulnerability/GHSA-jwcm-9g39-pmcw · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3296 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-53858 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53759 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53858 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53858 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8012-1 · Vendor Advisory