PT-2024-8770 · Github+3 · Github Cli+3

Ry0Tak + 1 · Published 2024-11-14 · Updated 2025-08-12 · CVE-2024-52308

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GitHub CLI versions 2.6.1 and earlier

Description: The issue is related to remote code execution through a malicious codespace SSH server when using gh codespace ssh or gh codespace logs commands. This occurs when a malicious third-party devcontainer contains a modified SSH server that injects ssh arguments within the SSH connection details, allowing arbitrary code execution on the user's workstation if the remote username contains something like -oProxyCommand="echo hacked" #. The -oProxyCommand flag causes ssh to execute the provided command while # shell comment causes any other ssh arguments to be ignored. In version 2.62.0, the remote username information is being validated before being used.

Recommendations: Upgrade to version 2.62.0 to fix the issue. As a temporary workaround, consider validating the remote username information before using it in ssh commands. Exercise caution when using custom devcontainer images, prefer default or pre-built devcontainers from trusted sources.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

AZL-53217

BDU:2024-10385

CVE-2024-52308

GHSA-P2H2-3VG9-4P87

GO-2024-3269

OPENSUSE-SU-2024:14509-1

OPENSUSE-SU-2024:14513-1

OPENSUSE-SU-2025:0021-1

USN-7130-1

Affected Products

Debian

Github Cli

Linuxmint

Ubuntu

References · 47

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52308.json · Exploit
• https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-53217 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7130-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3269 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0021-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52308 · Security Note
• https://osv.dev/vulnerability/GHSA-p2h2-3vg9-4p87 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-52308 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/714727 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14509-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7130-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-52308 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-52308 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52308 · Vendor Advisory