GitHub Enterprise Server vulnerable to critical auth bypass flaw

A critical vulnerability affecting multiple versions of GitHub Enterprise Server could be exploited to bypass authentication and enable an attacker to gain administrator privileges on the machine.

The security issue is identified as CVE-2024-6800 and received a 9.5 severity rating as per the CVSS 4.0 standard. It is described as an XML signature wrapping problem that occurs when using the Security Assertion Markup Language (SAML) authentication standard with certain identity providers.

“On GitHub Enterprise Server instances that use SAML single sign-on (SSO) authentication with specific IdPs utilizing publicly exposed signed federation metadata XML, an attacker could forge a SAML response to provision and/or gain access to a user account with site administrator privileges.” – GitHub

GitHub Enterprise Server (GHES) is a local version of GitHub for businesses that lack the experience for working with the public cloud or want to manage access and security controls.

According to the FOFA search engine for network assets exposed on the public web, there are more than 36,500 GHES instances accessible over the internet, most of them (29,200) located in the United States.

However, it is unclear how many of the exposed GHES machines are running a vulnerable version of the product.

Fofa scan results for internet-exposed GHES instances
Source: BleepingComputer

GitHub has addressed the issue in GHES versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16.

The new GHES releases also include fixes for two other vulnerabilities, both with a medium severity score:

All three security issues were reported through GitHub's Bug Bounty program on the HackerOne platform.

GitHub warns that some services might show errors during the configuration process after applying the security updates but instance should still start correctly.

Several issues related to log entries, memory utilization, and service interruptions during specific operations are also noted in the bulletin, so system admins are advised to check the ‘Known issues’ section before they apply the update.