CVE-2023-46647
📋 TL;DR
This vulnerability allows users with authorized access to the management console with an editor role in GitHub Enterprise Server to escalate their privileges by exploiting an endpoint used for bootstrapping the instance. It affects all versions from 3.8.0 and above, potentially enabling unauthorized administrative access. Organizations running vulnerable versions are at risk of insider threats or compromised accounts.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with editor role access gains full administrative control over the GitHub Enterprise Server instance, allowing them to modify configurations, access sensitive data, or disrupt operations.
Likely Case
A malicious insider or compromised account with editor privileges escalates to administrator, leading to unauthorized changes or data exposure within the system.
If Mitigated
With proper access controls and monitoring, impact is limited to isolated privilege misuse, quickly detected and contained.
🎯 Exploit Status
Exploitation requires authenticated access with editor role, making it straightforward for authorized users but not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.12, 3.9.6, 3.10.3, or 3.11.0
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0
Restart Required: Yes
Instructions:
1. Backup your instance. 2. Upgrade to a fixed version (e.g., 3.11.0) via the management console or command line. 3. Restart the server as prompted. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Management Console Access
allLimit access to the management console to only trusted administrators, reducing the attack surface for editor role users.
Configure network ACLs or firewall rules to restrict access to the management console IP/port.
🧯 If You Can't Patch
- Monitor and audit all management console access logs for suspicious activity, especially from editor role users.
- Implement least privilege principles by reviewing and minimizing editor role assignments to essential personnel only.
🔍 How to Verify
Check if Vulnerable:
Check the GitHub Enterprise Server version via the management console or run: ghe-versionCheck Version:
ghe-versionVerify Fix Applied:
After patching, confirm the version is 3.8.12, 3.9.6, 3.10.3, or 3.11.0 using the same command and test editor role access to bootstrap endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to bootstrap-related endpoints from editor role users in management console logs.
Network Indicators:
- Suspicious HTTP requests to management console bootstrap APIs from internal IPs.
SIEM Query:
source="github-enterprise" AND (endpoint="*bootstrap*" OR action="privilege_escalation") AND user_role="editor"🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.3
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.6
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.3
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.6
