GitHub fixed a new critical flaw in the GitHub Enterprise Server
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-4985 | An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional en An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program. NVD description · AI analysis pending | 10.0 | 3% |
| — | ||
| CVE-2024-6800 | An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program. NVD description · AI analysis pending | 9.5 group max | 2% |
| — |
Full article345 words · extracted from securityaffairs.com · click to collapse
GitHub addressed three vulnerabilities in its GitHub Enterprise Server product, including a critical authentication flaw.
GitHub addressed three security vulnerabilities impacting the GitHub Enterprise Server (GHES), including a critical flaw tracked as CVE-2024-6800 (CVSS score of 9.5). An attacker can trigger the vulnerability to gain site administrator privileges.
The vulnerability resides in the GHES’s SAML authentication and allows attackers with network access to forge SAML responses, potentially granting unauthorized site administrator access without prior authentication.
“On GitHub Enterprise Server instances that use SAML single sign-on (SSO) authentication with specific IdPs utilizing publicly exposed signed federation metadata XML, an attacker could forge a SAML response to provision and/or gain access to a user account with site administrator privileges. GitHub has requested CVE ID CVE-2024-6800 for this vulnerability, which was reported via the GitHub Bug Bounty program.” reads the advisory.
This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14. GitHub addressed the flaw in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. The vulnerability was reported via the GitHub Bug Bounty program.
The other issues addressed by the company are two medium-severity vulnerabilities in GHES. The first flaw (CVE-2024-7711) allowed an attacker to modify issue details in public repositories. The second flaw (CVE-2024-6337) enabled an attacker to disclose issue contents from private repositories using a GitHub App with specific permissions. Both vulnerabilities were reported through GitHub’s Bug Bounty program.
GitHub Enterprise Server (GHES) is a self-hosted version of GitHub designed for use within organizations. It provides the full capabilities of GitHub, including source code management, version control, collaboration tools, and continuous integration and delivery (CI/CD), but allows organizations to host the platform on their own infrastructure. This setup is ideal for companies that require more control over their data, enhanced security, and customization to meet internal compliance and regulatory requirements.
In May, GitHub rolled out security fixes to address a critical authentication bypass issue, tracked as CVE-2024-4985 (CVSS score: 10.0), in the GHES.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GHES)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/167387/security/github-enterprise-server-critical-flaw.html