CVE-2024-1084 Overview
CVE-2024-1084 is a Cross-Site Scripting (XSS) vulnerability in GitHub Enterprise Server. The flaw resides in the tag name pattern field within the tag protections user interface. An attacker can craft a malicious website that leverages the injection to bypass Content Security Policy (CSP) using forged Cross-Site Request Forgery (CSRF) tokens. Successful exploitation requires user interaction and social engineering. Once triggered, the attacker can make changes to the target user's account. The issue was reported through the GitHub Bug Bounty program and affects all GitHub Enterprise Server releases prior to 3.12. It is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Successful exploitation allows an attacker to execute script in the victim's authenticated session, bypass CSP protections, and perform account modifications on GitHub Enterprise Server.
Affected Products
- GitHub Enterprise Server versions prior to 3.8.15
- GitHub Enterprise Server versions 3.9.0 through 3.9.9, 3.10.0 through 3.10.6, and 3.11.0 through 3.11.4
- All GitHub Enterprise Server versions earlier than 3.12
Discovery Timeline
- 2024-02-13 - CVE-2024-1084 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1084
Vulnerability Analysis
The vulnerability is a stored or reflected XSS condition in the tag protections administrative UI of GitHub Enterprise Server. The tag name pattern field fails to properly neutralize user-supplied input before rendering it in the browser. An attacker can inject script content that executes in the context of the GitHub Enterprise Server origin. The impact is amplified because the injected script can bypass the deployed Content Security Policy by generating valid CSRF tokens on the fly. With those tokens, the script can issue state-changing requests against the victim's account. Exploitation requires the victim to visit an attacker-controlled page and perform a specific interaction, which limits the attack to social-engineering scenarios.
Root Cause
The root cause is missing output encoding on the tag name pattern parameter in the tag protections interface [CWE-79]. Untrusted input reaches the DOM without HTML or attribute-context escaping. Once rendered, the payload executes with the privileges of the browser session tied to the GitHub Enterprise Server application.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a malicious page that entices an authenticated GitHub Enterprise Server user to trigger a request or navigate to a crafted URL. The payload is delivered through the tag name pattern parameter and executes in the victim's browser. The script then forges CSRF tokens to bypass CSP restrictions and calls authenticated endpoints to modify the user account. No prior privileges are required by the attacker, but the victim must be logged in.
No verified public proof-of-concept exploit code has been released for this issue. Refer to the GitHub Enterprise Release Notes 3.11.5 for vendor details on the fix.
Detection Methods for CVE-2024-1084
Indicators of Compromise
- Unexpected creation or modification of tag protection rules containing script tags, event handlers, or JavaScript URIs in the tag name pattern field.
- Outbound requests from user browsers to unfamiliar external domains immediately after visiting GitHub Enterprise Server pages.
- Unauthorized changes to user profile settings, SSH keys, personal access tokens, or repository access shortly after user interaction with an external link.
Detection Strategies
- Review GitHub Enterprise Server audit logs for protected_tag.create and protected_tag.update events referencing suspicious pattern values.
- Inspect web application firewall or reverse proxy logs for POST requests to tag protection endpoints containing HTML control characters such as <, >, or on*= attribute patterns.
- Correlate account-modification events with anomalous referrer headers pointing to external, non-corporate origins.
Monitoring Recommendations
- Enable and centralize GitHub Enterprise Server audit log streaming to a SIEM or data lake for query-based hunts.
- Alert on tag protection rule changes performed by non-administrator accounts or outside standard change windows.
- Monitor for authenticated API calls that alter user account settings following browser navigation events tied to XSS payload delivery.
How to Mitigate CVE-2024-1084
Immediate Actions Required
- Upgrade GitHub Enterprise Server to 3.8.15, 3.9.10, 3.10.7, 3.11.5, or any later release such as 3.12 or above.
- Audit existing tag protection rules across all repositories for suspicious pattern values and remove any that contain markup or script content.
- Rotate personal access tokens, SSH keys, and session cookies for any account suspected of interacting with a malicious link.
Patch Information
GitHub fixed the vulnerability in GitHub Enterprise Server versions 3.8.15, 3.9.10, 3.10.7, and 3.11.5. Versions 3.12 and later are not affected. See the GitHub Enterprise Release Notes 3.8.15, 3.9.10, 3.10.7, and 3.11.5 for upgrade instructions.
Workarounds
- Restrict who can create or modify tag protection rules to a small set of trusted administrators until patching is complete.
- Train users to avoid clicking unsolicited links that reference internal GitHub Enterprise Server URLs and to verify the source of any workflow requiring authentication.
- Enforce browser isolation or strict CSP reporting on the GitHub Enterprise Server domain to surface script-execution attempts during triage.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
