CVE-2024-1374
📋 TL;DR
A command injection vulnerability in GitHub Enterprise Server allows authenticated users with editor role in the Management Console to execute arbitrary commands and gain admin SSH access when configuring audit log forwarding. This affects all GitHub Enterprise Server instances prior to version 3.12. Attackers need both access to the instance and editor privileges in the Management Console.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GitHub Enterprise Server appliance with admin SSH access, allowing data exfiltration, code repository manipulation, and lateral movement within the environment.
Likely Case
Privileged escalation from editor to admin, enabling unauthorized access to sensitive data and system configuration.
If Mitigated
Limited impact due to proper access controls and monitoring, with only authorized users having Management Console access.
🎯 Exploit Status
Exploitation requires authenticated access with editor role in Management Console; command injection occurs via nomad templates in audit log forwarding configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.11.5, 3.10.7, 3.9.10, or 3.8.15
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Upgrade to patched version (3.11.5, 3.10.7, 3.9.10, or 3.8.15). 3. Follow GitHub's upgrade documentation for your version. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict Management Console Access
allLimit Management Console access to only essential administrators; remove editor roles from non-essential users.
Disable Audit Log Forwarding
allTemporarily disable audit log forwarding configuration if not required.
🧯 If You Can't Patch
- Implement strict access controls to Management Console; only grant editor role to trusted administrators.
- Monitor Management Console access logs and audit log configuration changes for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check GitHub Enterprise Server version via Management Console or SSH: if version is below 3.12 and not one of the patched versions (3.11.5, 3.10.7, 3.9.10, 3.8.15), you are vulnerable.Check Version:
ssh admin@your-ghes-instance 'cat /etc/github-enterprise-version'Verify Fix Applied:
After patching, verify version shows 3.11.5, 3.10.7, 3.9.10, 3.8.15 or higher in Management Console or via SSH.📡 Detection & Monitoring
Log Indicators:
- Unusual audit log forwarding configuration changes
- SSH access from unexpected users or IPs
- Commands executed via Management Console with editor role
Network Indicators:
- Unexpected SSH connections to GitHub Enterprise Server appliance
SIEM Query:
source="github-enterprise" AND (event="audit_log_config_change" OR event="ssh_login")🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.15
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5
- https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.15
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10
