CVE-2024-1354
📋 TL;DR
A command injection vulnerability in GitHub Enterprise Server allows authenticated users with editor role in the Management Console to execute arbitrary commands and gain admin SSH access via syslog-ng configuration manipulation. This affects all GitHub Enterprise Server instances prior to version 3.12. Attackers need both access to the instance and Management Console editor privileges.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GitHub Enterprise Server appliance with admin SSH access, enabling data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Privileged escalation from editor to admin, allowing configuration changes, user management, and access to all repositories and settings.
If Mitigated
Limited to authorized editor users who might misuse their legitimate access, with proper monitoring detecting unusual configuration changes.
🎯 Exploit Status
Exploitation requires authenticated access with editor role in Management Console; command injection via syslog-ng configuration file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11.5, 3.10.7, 3.9.10, 3.8.15, or any version 3.12+
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7
Restart Required: Yes
Instructions:
1. Backup your instance. 2. Download the patched version from GitHub Enterprise downloads. 3. Follow upgrade instructions at https://docs.github.com/en/enterprise-server/admin/installation/upgrading-github-enterprise-server. 4. Restart the appliance.
🔧 Temporary Workarounds
Restrict Management Console Access
allLimit Management Console editor roles to only essential administrators; review and reduce editor privileges.
Monitor syslog-ng Configuration Changes
linuxImplement file integrity monitoring on /etc/syslog-ng/syslog-ng.conf and related configuration files.
auditctl -w /etc/syslog-ng/syslog-ng.conf -p wa -k syslog_config
🧯 If You Can't Patch
- Immediately restrict Management Console editor roles to minimal trusted personnel only.
- Implement strict monitoring and alerting for any syslog-ng configuration file modifications or unusual SSH access patterns.
🔍 How to Verify
Check if Vulnerable:
Check current version via Management Console or SSH: cat /etc/github-enterprise-versionCheck Version:
cat /etc/github-enterprise-versionVerify Fix Applied:
Verify version is 3.11.5, 3.10.7, 3.9.10, 3.8.15, or any 3.12+ release.📡 Detection & Monitoring
Log Indicators:
- Unauthorized modifications to /etc/syslog-ng/syslog-ng.conf
- Unexpected SSH access from Management Console users
- Commands containing injection patterns in syslog configuration
Network Indicators:
- Unusual SSH connections from the GitHub appliance to internal/external systems
SIEM Query:
source="github-enterprise" AND (event="config_change" AND file="/etc/syslog-ng/syslog-ng.conf") OR (event="ssh_login" AND user="admin")🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.15
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.15
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10
