CVE-2024-0200: GitHub Enterprise Server RCE Vulnerability

CVE-2024-0200 Overview

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3. This vulnerability was reported via the GitHub Bug Bounty program.

Critical Impact

This unsafe reflection vulnerability enables authenticated attackers with organization owner privileges to execute arbitrary code on GitHub Enterprise Server instances, potentially leading to complete system compromise and unauthorized access to all hosted repositories and sensitive data.

Affected Products

• GitHub Enterprise Server versions prior to 3.8.13
• GitHub Enterprise Server versions prior to 3.9.8
• GitHub Enterprise Server versions prior to 3.10.5
• GitHub Enterprise Server versions prior to 3.11.3

Discovery Timeline

• 2024-01-16 - CVE-2024-0200 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0200

Vulnerability Analysis

The unsafe reflection vulnerability (CWE-470) in GitHub Enterprise Server allows attackers to manipulate the reflection mechanism to invoke arbitrary methods. Reflection injection occurs when an application uses untrusted input to dynamically resolve class names, method names, or other reflection-related parameters without proper validation. In this case, an authenticated attacker with organization owner privileges can craft malicious input that is processed by the reflection mechanism, allowing them to invoke methods that were not intended to be accessible through normal application flow.

The vulnerability requires the attacker to hold organization owner role privileges within the GHES instance, which somewhat limits the attack surface. However, organizations often have multiple owners, and compromised credentials of any organization owner could be leveraged to exploit this vulnerability. Once exploited, the attacker gains the ability to execute arbitrary code on the server, potentially compromising the entire GitHub Enterprise Server installation along with all hosted repositories and secrets.

Root Cause

The root cause of CVE-2024-0200 is improper validation of user-supplied input that is used in reflection operations. When the application dynamically resolves and invokes methods based on user-controllable data, it fails to adequately restrict which methods can be called. This allows an attacker to specify arbitrary class and method names, bypassing intended access controls and executing sensitive operations that should not be reachable through the normal application interface.

Attack Vector

The attack vector for this vulnerability is network-based and requires authenticated access with organization owner privileges. An attacker must first obtain valid credentials for an account with the organization owner role on the target GHES instance. Once authenticated, the attacker can craft specially formatted requests that inject malicious reflection parameters, causing the server to invoke arbitrary methods. This can ultimately lead to remote code execution, allowing the attacker to execute system commands, access sensitive data, or establish persistence on the compromised server.

The exploitation process involves identifying endpoints that utilize reflection and then manipulating the input parameters to control the reflected method invocation. While specific technical details have not been publicly disclosed, the general attack pattern involves supplying class and method names that the application will resolve and execute, enabling the attacker to call sensitive internal functions or system-level operations.

Detection Methods for CVE-2024-0200

Indicators of Compromise

• Unusual API requests from organization owner accounts targeting reflection-related endpoints
• Unexpected method invocations or system calls originating from the GHES application process
• Anomalous network connections or process spawns initiated by the GHES server
• Evidence of unauthorized repository access or data exfiltration from the GHES instance

Detection Strategies

• Monitor authentication logs for suspicious organization owner account activity, particularly from unusual IP addresses or during off-hours
• Implement application-level logging to capture reflection operations and flag unexpected method invocations
• Deploy behavioral analysis to detect anomalous patterns in GHES application behavior
• Utilize endpoint detection and response (EDR) solutions to identify post-exploitation activities

Monitoring Recommendations

• Enable comprehensive audit logging on the GitHub Enterprise Server instance
• Configure alerting for privileged account actions, especially those involving administrative or owner-level operations
• Review GHES application logs regularly for signs of injection attempts or unusual error patterns
• Implement network monitoring to detect unexpected outbound connections from the GHES server

How to Mitigate CVE-2024-0200

Immediate Actions Required

• Upgrade GitHub Enterprise Server to a patched version (3.8.13, 3.9.8, 3.10.5, 3.11.3, or later) immediately
• Audit organization owner accounts to ensure all are legitimate and review recent activity
• Rotate credentials for any accounts with organization owner privileges as a precautionary measure
• Review GHES logs for any signs of exploitation prior to patching

Patch Information

GitHub has released security patches addressing this vulnerability in multiple supported versions. Organizations should update to the following versions or later:

• GitHub Enterprise Server 3.8.13
• GitHub Enterprise Server 3.9.8
• GitHub Enterprise Server 3.10.5
• GitHub Enterprise Server 3.11.3

Organizations running versions prior to 3.12 should prioritize this update given the critical severity and potential for remote code execution.

Workarounds

• Restrict network access to the GHES instance to trusted IP ranges only until patching is complete
• Implement additional authentication controls such as multi-factor authentication for organization owner accounts
• Temporarily reduce the number of organization owner accounts to minimize the attack surface
• Consider placing the GHES instance behind a web application firewall (WAF) with rules to detect reflection injection attempts

# Verify your current GitHub Enterprise Server version
ghe-version

# Upgrade to a patched version (example for 3.11.3)
# Follow GitHub's official upgrade documentation for your environment
ghe-upgrade -y GitHub-Enterprise-3.11.3.pkg