CVE-2024-52308
📋 TL;DR
This vulnerability allows remote code execution on a developer's workstation when using GitHub CLI to connect to malicious codespaces. Attackers can inject arbitrary commands through manipulated SSH connection details. Developers using GitHub CLI versions 2.6.1 and earlier with the `gh codespace ssh` or `gh codespace logs` commands are affected.
💻 Affected Systems
- GitHub CLI
📦 What is this software?
Cli by Github
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of developer workstation leading to credential theft, lateral movement, and data exfiltration.
Likely Case
Execution of arbitrary commands on developer machine, potentially installing malware or stealing sensitive information.
If Mitigated
No impact if using patched version or avoiding connection to untrusted codespaces.
🎯 Exploit Status
Exploitation requires user to connect to a malicious codespace. The vulnerability is well-documented in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.62.0
Vendor Advisory: https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87
Restart Required: No
Instructions:
1. Update GitHub CLI to version 2.62.0 or later. 2. Run: `gh upgrade` or download from GitHub releases. 3. Verify update with: `gh --version`.
🔧 Temporary Workarounds
Avoid untrusted codespaces
allOnly connect to codespaces from trusted sources and verified repositories.
Use alternative SSH methods
allManually retrieve SSH connection details and validate before using standard SSH client.
gh codespace ssh -c CODESPACE_NAME -- --dry-run
🧯 If You Can't Patch
- Disable or restrict use of `gh codespace ssh` and `gh codespace logs` commands
- Implement network segmentation to isolate developer workstations from potential malicious codespaces
🔍 How to Verify
Check if Vulnerable:
Check GitHub CLI version: `gh --version`. If version is 2.6.1 or earlier, you are vulnerable.Check Version:
gh --versionVerify Fix Applied:
Run `gh --version` and confirm version is 2.62.0 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual SSH connection attempts from GitHub CLI
- Unexpected command execution following codespace connections
Network Indicators:
- SSH connections to unexpected hosts from developer workstations
SIEM Query:
Process execution where parent process is 'gh' and command contains suspicious arguments like '-oProxyCommand'