CVE-2025-11892
📋 TL;DR
This DOM-based XSS vulnerability in GitHub Enterprise Server allows attackers to execute malicious scripts when users click crafted links in Issues search label filters. It affects all GitHub Enterprise Server instances prior to specific patched versions and requires attacker access plus user interaction in sudo mode.
💻 Affected Systems
- GitHub Enterprise Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete privilege escalation allowing unauthorized workflow triggers, data exfiltration, and administrative control compromise.
Likely Case
Unauthorized workflow execution and limited privilege escalation within the compromised user's scope.
If Mitigated
No impact if proper input validation and output encoding are implemented.
🎯 Exploit Status
Requires attacker access to GitHub Enterprise Server instance and social engineering to trick users into clicking malicious links while in sudo mode.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.18.1, 3.17.7, 3.16.10, 3.15.14, or 3.14.19 depending on current version
Vendor Advisory: https://docs.github.com/en/enterprise-server/admin/release-notes
Restart Required: Yes
Instructions:
1. Backup your GitHub Enterprise Server instance. 2. Download appropriate patch version from GitHub Enterprise releases. 3. Apply update via management console or CLI. 4. Restart services as prompted.
🔧 Temporary Workarounds
Disable Issues search label filter
allTemporarily disable the vulnerable feature until patching.
Requires administrative configuration changes in GitHub Enterprise settings
Restrict sudo mode access
allLimit users who can enter sudo mode and reduce session durations.
Configure via GitHub Enterprise administrative settings
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
- Educate users about phishing risks and require MFA for sudo mode operations
🔍 How to Verify
Check if Vulnerable:
Check current version via GitHub Enterprise Server management console or SSH: cat /data/user/common/version-info.jsonCheck Version:
ssh admin@your-instance 'cat /data/user/common/version-info.json | grep version_string'Verify Fix Applied:
Verify version is 3.18.1, 3.17.7, 3.16.10, 3.15.14, or 3.14.19 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual workflow triggers from unexpected users
- Multiple failed sudo mode attempts followed by successful execution
Network Indicators:
- Suspicious outbound connections following Issues search activities
SIEM Query:
source="github-enterprise" AND (event="workflow_trigger" OR event="sudo_mode") AND user NOT IN approved_users🔗 References
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.19
- https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.14
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.10
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.7
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.1
