CVE-2024-0200

HIGHNuclei

Unsafe Reflection in Github Enterprise Server leading to Command Injection

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-0200 has a selected CVSS score of 7.2 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 22, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Enterprise Server

Browse GitHub / Enterprise Server

Default status: affected, unknown

CVE List3.8.0 to < 3.8.13affected
3.9.0 to < 3.9.8affected
3.10.0 to < 3.10.5affected
3.11.0 to < 3.11.3affected
3.8.0affected

Proofs of concept

1

Repository PoCs

GitHubconvisolabs/CVE-2024-0507_CVE-2024-0200-githubRepository PoCby convisolabs1Not analyzed6 files

730.8 KiB · linked to 2 vulnerabilities

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALGithub Enterprise - Remote Code ExecutionCVSS 9.8

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3.

Impact

Authenticated attackers with organization owner privileges can exploit unsafe reflection to execute arbitrary code remotely, leading to complete compromise of the GitHub Enterprise Server instance and potential access to all repositories and data.

Remediation

Upgrade to GitHub Enterprise Server version 3.8.13, 3.9.8, 3.10.5, or 3.11.3 or later.

WeaknessesCWE-470
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024rcegithubenterprisevulnauthenticated
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*
Shodan: title:"GitHub Enterprise"
Shodan: micro focus dsd
FOFA: app="Github-Enterprise"
https://starlabs.sg/blog/2024/04-sending-myself-github-com-environment-variables-and-ghes-shell/ https://blog.convisoappsec.com/en/analysis-of-github-enterprise-vulnerabilities-cve-2024-0507-cve-2024-0200/ https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.5 https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.3 https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.13

Source: ProjectDiscovery

References

5