CVE-2024-6336
📋 TL;DR
A security misconfiguration in GitHub Enterprise Server allowed unauthorized users to access sensitive information when an organization member changed a dependent repository from private to public. This vulnerability affected all GitHub Enterprise Server versions prior to 3.14, exposing potentially confidential data through the organization ruleset feature.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized disclosure of sensitive source code, credentials, or proprietary information from private repositories to external actors.
Likely Case
Accidental exposure of internal repositories when organization members change visibility settings, potentially revealing development secrets or internal tools.
If Mitigated
Minimal impact with proper access controls and monitoring, though configuration errors could still lead to limited data exposure.
🎯 Exploit Status
Exploitation requires authenticated organization member to change repository visibility, making it less likely for external attackers but still dangerous from insider threats.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.13.1, 3.12.6, 3.11.12, 3.10.14, 3.9.17
Vendor Advisory: https://docs.github.com/en/enterprise-server/admin/release-notes
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Download appropriate patched version from GitHub Enterprise Server releases. 3. Follow upgrade procedures for your current version to target patched version. 4. Restart GitHub Enterprise Server services.
🔧 Temporary Workarounds
Restrict Repository Visibility Changes
allImplement organization policies to restrict who can change repository visibility from private to public.
Audit Repository Visibility Settings
allRegularly audit all repositories to ensure sensitive ones remain private and review visibility change logs.
🧯 If You Can't Patch
- Implement strict access controls on who can modify repository visibility settings within organizations.
- Enable comprehensive logging and monitoring of repository visibility changes and access patterns.
🔍 How to Verify
Check if Vulnerable:
Check GitHub Enterprise Server version via admin dashboard or SSH into instance and run 'ghe-version' command.Check Version:
ssh admin@github-enterprise-instance 'ghe-version'Verify Fix Applied:
Verify version is 3.13.1, 3.12.6, 3.11.12, 3.10.14, 3.9.17 or later, and test that changing repository visibility no longer exposes sensitive information.📡 Detection & Monitoring
Log Indicators:
- Repository visibility change events in audit logs
- Unauthorized access attempts to newly public repositories
Network Indicators:
- Unusual traffic patterns to previously private repository URLs
SIEM Query:
source="github_audit_log" event="repository.visibility_change" visibility="public"🔗 References
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17
- https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.15
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.12
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.6
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.1
- https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.17
