CVE-2024-4985
📋 TL;DR
This CVE describes an authentication bypass vulnerability in GitHub Enterprise Server when using SAML SSO with encrypted assertions. Attackers can forge SAML responses to create or access site administrator accounts without authentication. All GHES versions before 3.13.0 are affected.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GitHub Enterprise Server instance with attacker gaining site administrator privileges, allowing data theft, code manipulation, and full system control.
Likely Case
Unauthorized access to administrative functions, potential data exfiltration, and privilege escalation within the GitHub instance.
If Mitigated
Limited impact with proper network segmentation and monitoring, but still represents a critical authentication bypass.
🎯 Exploit Status
Requires knowledge of SAML response forging and targeting of GHES instances with specific SAML configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.15, 3.10.12, 3.11.10, 3.12.4, or 3.13.0+
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.12
Restart Required: Yes
Instructions:
1. Backup your GHES instance. 2. Upgrade to patched version (3.9.15, 3.10.12, 3.11.10, 3.12.4, or 3.13.0+). 3. Restart the instance. 4. Verify SAML authentication works correctly.
🔧 Temporary Workarounds
Disable SAML Encrypted Assertions
allTemporarily disable the encrypted assertions feature in SAML configuration until patching is possible.
Navigate to Management Console > Authentication > SAML > Disable 'Encrypt assertions'
🧯 If You Can't Patch
- Disable SAML SSO entirely and use alternative authentication methods
- Implement strict network access controls to limit GHES access to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check GHES version via Management Console or SSH: if version is below 3.9.15, 3.10.12, 3.11.10, 3.12.4, or 3.13.0, and SAML with encrypted assertions is enabled, the system is vulnerable.Check Version:
ssh admin@GHES-instance 'ghes-version' or check Management Console dashboardVerify Fix Applied:
After patching, verify version is 3.9.15+, 3.10.12+, 3.11.10+, 3.12.4+, or 3.13.0+ and test SAML authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected SAML authentication attempts
- Administrator account creation from unusual sources
- Failed SAML decryption errors
Network Indicators:
- Unusual SAML response traffic to GHES instance
- Authentication requests from unexpected IP addresses
SIEM Query:
source="github-enterprise" AND (event="saml_auth" OR event="user_create") AND result="success" | stats count by src_ip, user🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.12
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.4
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.15
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.12
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.4
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.15
