CVE-2024-9487

CVE-2024-9487 is an improper verification of cryptographic signature flaw (CWE-347) in GitHub Enterprise Server that allows SAML SSO authentication to be bypassed. Exploitation requires the encrypted assertions feature to be enabled, direct network access to the instance, and a signed SAML response or metadata document supplied by the attacker. A successful attack results in unauthorized provisioning of users and unauthorized access to the instance. All GitHub Enterprise Server versions prior to 3.15 are affected, with fixes shipped in 3.11.16, 3.12.10, 3.13.5, and 3.14.2. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 25.6% probability of exploitation within 30 days (98th percentile), indicating elevated risk.

What to do: Upgrade GitHub Enterprise Server to version 3.14.2, 3.13.5, 3.12.10, or 3.11.16 (or any 3.15+ release). Administrators who cannot patch immediately should verify whether SAML SSO with encrypted assertions is enabled, limit direct network access to the instance, and review user provisioning logs for unexpected accounts. This flaw was reported via the GitHub Bug Bounty program and is not yet in CISA KEV.