CVE-2024-3646
📋 TL;DR
A command injection vulnerability in GitHub Enterprise Server allows attackers with editor role access to the Management Console to execute arbitrary commands and gain admin SSH access when configuring chat integration. This affects all GitHub Enterprise Server instances prior to version 3.12. The vulnerability requires authenticated access to the Management Console with editor privileges.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GitHub Enterprise Server instance with admin SSH access, allowing data exfiltration, code manipulation, and persistent backdoor installation.
Likely Case
Unauthorized admin access leading to repository manipulation, user account compromise, and potential lateral movement within the enterprise network.
If Mitigated
Limited impact due to restricted Management Console access and proper role-based access controls preventing editor role assignment to untrusted users.
🎯 Exploit Status
Exploitation requires authenticated access to Management Console with editor role. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.12.2, 3.11.8, 3.10.10, or 3.9.13
Vendor Advisory: https://docs.github.com/en/enterprise-server/admin/release-notes
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Download the appropriate patch version from GitHub Enterprise downloads. 3. Follow the upgrade instructions for your version. 4. Restart the instance after upgrade completion.
🔧 Temporary Workarounds
Restrict Management Console Access
allLimit Management Console access to only trusted administrators and remove editor roles from potentially compromised accounts.
Disable Chat Integration
allRemove or disable chat integration configuration in Management Console to eliminate the attack vector.
🧯 If You Can't Patch
- Implement strict access controls for Management Console and regularly audit editor role assignments.
- Monitor SSH access logs for unusual admin activity and implement network segmentation for GitHub Enterprise Server.
🔍 How to Verify
Check if Vulnerable:
Check your GitHub Enterprise Server version via Management Console or SSH. If version is below 3.12, you are vulnerable.Check Version:
ssh admin@your-ghes-instance 'ghes-version' or check in Management Console under Support > VersionVerify Fix Applied:
After patching, verify version is 3.12.2, 3.11.8, 3.10.10, or 3.9.13. Test chat integration configuration to ensure no command injection occurs.📡 Detection & Monitoring
Log Indicators:
- Unusual SSH login attempts from Management Console IPs
- Chat integration configuration changes followed by admin SSH access
- Command execution patterns in application logs
Network Indicators:
- Unexpected SSH connections from GitHub Enterprise Server to internal systems
- Anomalous outbound connections after chat integration changes
SIEM Query:
source="github-enterprise" AND (event="ssh_login" AND user="admin") OR (event="management_console" AND action="chat_integration_update")🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.10
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.8
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.2
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.13
