CVE-2024-5746
📋 TL;DR
A Server-Side Request Forgery vulnerability in GitHub Enterprise Server allows authenticated site administrators to execute arbitrary code on the server instance. This affects all GitHub Enterprise Server versions prior to 3.13, putting organizations using vulnerable versions at risk of complete system compromise.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GitHub Enterprise Server instance, allowing attackers to steal source code, modify repositories, access sensitive data, and pivot to internal networks.
Likely Case
Unauthorized code execution leading to data exfiltration, repository manipulation, and potential lateral movement within the organization's infrastructure.
If Mitigated
Limited impact due to strict access controls and monitoring, but still represents a significant security risk requiring immediate remediation.
🎯 Exploit Status
Exploitation requires authenticated access with Site Administrator privileges, which reduces attack surface but increases impact for compromised accounts
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.12.5, 3.11.11, 3.10.13, or 3.9.16
Vendor Advisory: https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Download the appropriate patched version from GitHub Enterprise Server releases. 3. Follow the upgrade instructions for your specific version. 4. Restart the server after upgrade completion.
🔧 Temporary Workarounds
Restrict Site Administrator Access
allLimit the number of users with Site Administrator role to only essential personnel
Implement Network Segmentation
allRestrict GitHub Enterprise Server's outbound network access to prevent SSRF exploitation
🧯 If You Can't Patch
- Immediately audit and reduce Site Administrator accounts to absolute minimum
- Implement strict monitoring and alerting for Site Administrator account activities
🔍 How to Verify
Check if Vulnerable:
Check your GitHub Enterprise Server version via the Management Console or SSH into the instance and run 'ghe-version'Check Version:
ssh admin@your-ghe-instance 'ghe-version'Verify Fix Applied:
Verify version is 3.12.5, 3.11.11, 3.10.13, 3.9.16 or later using 'ghe-version' command📡 Detection & Monitoring
Log Indicators:
- Unusual SSRF patterns in application logs
- Suspicious administrator account activities
- Unexpected outbound network connections from GitHub server
Network Indicators:
- Unusual outbound HTTP/HTTPS requests from GitHub server to internal systems
- SSH connections from GitHub server to unexpected destinations
SIEM Query:
source="github-enterprise" AND (event_type="admin_activity" OR event_type="ssrf_attempt")🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.13
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.11
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.5
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.16
