Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-0507. PoCs published by convisolabs.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-0200, leveraging unsafe reflection to leak the ENTERPRISE_SESSION_SECRET and achieve remote code execution via Marshal deserialization in GitHub Enterprise Server. The exploit requires organization owner privileges and authenticates using provided credentials.
Description
An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program.
Exploits (1)
This repository contains a functional exploit for CVE-2024-0200, leveraging unsafe reflection to leak the ENTERPRISE_SESSION_SECRET and achieve remote code execution via Marshal deserialization in GitHub Enterprise Server. The exploit requires organization owner privileges and authenticates using provided credentials.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N