CVE-2023-6847
📋 TL;DR
This CVE describes an authentication bypass vulnerability in GitHub Enterprise Server's Private Mode. Attackers with network access can craft API requests to bypass authentication and access private resources. All GitHub Enterprise Server installations since version 3.9 are affected unless patched.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attackers gain full access to private repositories, source code, secrets, and sensitive data stored in the GitHub Enterprise Server instance.
Likely Case
Attackers bypass Private Mode to access internal repositories, potentially exposing proprietary code, credentials, and intellectual property.
If Mitigated
With proper network segmentation and access controls, only authorized internal users could potentially exploit this, limiting exposure.
🎯 Exploit Status
Exploitation requires network access to the appliance and knowledge of the specially crafted API request. No authentication is required to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.7, 3.10.4, or 3.11.1
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Download the appropriate patch version from GitHub Enterprise. 3. Follow the upgrade instructions for your version. 4. Restart the appliance after upgrade completion.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to GitHub Enterprise Server to only trusted IP addresses and networks.
Use firewall rules to limit access: iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GitHub Enterprise Server from untrusted networks
- Enable enhanced logging and monitoring for suspicious API requests to the appliance
🔍 How to Verify
Check if Vulnerable:
Check your GitHub Enterprise Server version via the Management Console or SSH. If version is between 3.9.0-3.9.6, 3.10.0-3.10.3, or 3.11.0, you are vulnerable.Check Version:
ssh admin@your-gh-enterprise-server 'ghes-version' or check via Management ConsoleVerify Fix Applied:
After patching, verify the version shows 3.9.7, 3.10.4, or 3.11.1 or higher. Test Private Mode functionality to ensure authentication is properly enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual API requests to authentication endpoints
- Access to private resources from unauthenticated sources
- Failed authentication attempts followed by successful access
Network Indicators:
- API requests with unusual headers or parameters to authentication endpoints
- Traffic patterns suggesting authentication bypass
SIEM Query:
source="github-enterprise" AND (event_type="api_request" AND (uri_path="/api/v3/*" OR uri_path="/api/graphql") AND user="anonymous")🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7
