CVE-2017-18365

CVE-2017-18365 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit, including a Metasploit module exploits/linux/http/github_enterprise_secret.

AI-analyzed exploit summary This Metasploit module exploits a hard-coded session secret and unsafe deserialization in GitHub Enterprise (2.8.0-2.8.6) to achieve remote code execution. It signs a malicious serialized Ruby object and sends it via a tampered cookie to trigger arbitrary command execution.

The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.