CVE-2021-41598
📋 TL;DR
This CVE describes a UI misrepresentation vulnerability in GitHub Enterprise Server where GitHub Apps could gain additional user-level permissions without displaying them to users during repository updates. An attacker could exploit this by creating a malicious GitHub App and tricking users into authorizing it, then later adding permissions without user consent. All GitHub Enterprise Server instances prior to version 3.3 are affected.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive repositories, source code, and user data through escalated GitHub App permissions, potentially leading to data theft, code manipulation, or supply chain attacks.
Likely Case
Malicious actors create GitHub Apps that appear legitimate but gain additional permissions over time, accessing private repositories and user data without proper authorization.
If Mitigated
With proper user awareness and monitoring, unauthorized permission escalations are detected and revoked before significant damage occurs.
🎯 Exploit Status
Exploitation requires creating a GitHub App and convincing users to authorize it, then modifying the app's permissions. This is a multi-step attack but could be automated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.5, 3.1.13, 3.0.21, or upgrade to 3.3+
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.21
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Upgrade to version 3.2.5, 3.1.13, 3.0.21, or any version 3.3+. 3. Follow GitHub's upgrade documentation for your specific version. 4. Restart the instance after upgrade.
🔧 Temporary Workarounds
Restrict GitHub App Creation
allLimit GitHub App creation to trusted administrators only to prevent malicious app registration.
Monitor GitHub App Permissions
allRegularly audit GitHub App permissions and review all authorized applications.
🧯 If You Can't Patch
- Implement strict policies requiring user approval for all GitHub App permission changes
- Monitor and audit all GitHub App installations and permission changes in real-time
🔍 How to Verify
Check if Vulnerable:
Check your GitHub Enterprise Server version via the management console or SSH into the instance and run 'ghe-version'Check Version:
ssh admin@your-ghe-instance 'ghe-version'Verify Fix Applied:
Verify the version is 3.2.5, 3.1.13, 3.0.21, or any version 3.3+ using 'ghe-version' command📡 Detection & Monitoring
Log Indicators:
- Unexpected GitHub App permission changes
- Multiple authorization requests for the same GitHub App
- GitHub App installations with unusual permission patterns
Network Indicators:
- Increased API calls from GitHub Apps
- Unusual data access patterns from GitHub Apps
SIEM Query:
source="github-enterprise" AND (event="app_authorization" OR event="permission_change") AND status="success" | stats count by app_name, user🔗 References
- https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21
- https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13
- https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5
- https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.21
- https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.13
- https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.5
