CVE-2023-23761
📋 TL;DR
An improper authentication vulnerability in GitHub Enterprise Server allows unauthorized users to modify other users' secret gists by authenticating through an SSH certificate authority. This affects all GitHub Enterprise Server versions prior to 3.9, requiring attackers to know the secret gist's URL to exploit it.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized modification or deletion of sensitive data in secret gists, potentially exposing confidential information or disrupting workflows.
Likely Case
Targeted modification of specific secret gists by users with knowledge of their URLs, leading to data integrity issues.
If Mitigated
Limited impact if secret gist URLs are not widely shared and proper access controls are in place.
🎯 Exploit Status
Exploitation requires knowledge of secret gist URLs and SSH certificate authority access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.18, 3.5.15, 3.6.11, 3.7.8, 3.8.1, or 3.9+
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.18
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Upgrade to a patched version (3.4.18, 3.5.15, 3.6.11, 3.7.8, 3.8.1, or 3.9+). 3. Follow GitHub's upgrade documentation for your version. 4. Restart the server after upgrade.
🔧 Temporary Workarounds
Disable SSH certificate authority authentication
allTemporarily disable SSH certificate authority authentication to prevent exploitation.
# Modify GitHub Enterprise Server configuration to disable SSH CA auth
# Refer to GitHub documentation for specific configuration steps
Restrict secret gist sharing
allLimit sharing of secret gist URLs and monitor for unauthorized access attempts.
🧯 If You Can't Patch
- Disable SSH certificate authority authentication if not required.
- Implement strict access controls and monitoring for secret gist modifications.
🔍 How to Verify
Check if Vulnerable:
Check your GitHub Enterprise Server version via the management console or SSH into the instance and run 'ghe-version'.Check Version:
ssh admin@your-ghe-instance 'ghe-version'Verify Fix Applied:
Verify the version is 3.4.18, 3.5.15, 3.6.11, 3.7.8, 3.8.1, or 3.9+ using 'ghe-version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual modifications to secret gists, especially from unauthorized users or SSH CA authenticated sessions.
Network Indicators:
- Unexpected SSH certificate authority authentication attempts to gist endpoints.
SIEM Query:
source="github-enterprise" action="gist_modify" user="*" auth_method="ssh_ca"🔗 References
- https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.18
- https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.15
- https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.11
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.8
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.1
- https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.18
- https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.15
- https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.11
- https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.8
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.1
