CVE-2024-2443: GitHub Enterprise Server RCE Vulnerability

CVE-2024-2443 Overview

CVE-2024-2443 is a command injection vulnerability in GitHub Enterprise Server (GHES) that allowed an authenticated attacker holding the editor role in the Management Console to gain administrative SSH access to the underlying appliance. The flaw resides in the handling of GeoJSON configuration settings, where user-supplied input was passed to a command interpreter without proper sanitization. GitHub received the report through its Bug Bounty program and patched the issue in GHES versions 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. The vulnerability is categorized under [CWE-20] Improper Input Validation.

Critical Impact
An authenticated Management Console editor can escalate to root-level SSH access on the GHES appliance, compromising the entire source code hosting platform and all repositories it hosts.

Affected Products

GitHub Enterprise Server versions prior to 3.8.17
GitHub Enterprise Server 3.9.x prior to 3.9.12, 3.10.x prior to 3.10.9, and 3.11.x prior to 3.11.7
GitHub Enterprise Server 3.12.x prior to 3.12.1

Discovery Timeline

2024-03-20 - CVE-2024-2443 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-2443

Vulnerability Analysis

The vulnerability exists in the Management Console workflow that processes GeoJSON configuration data. GHES accepts a GeoJSON payload for administrative configuration and passes portions of that input into a shell command execution path. Because the input is not sufficiently validated or escaped, an attacker can embed shell metacharacters that alter the executed command.

Successful exploitation grants the attacker administrative SSH access to the appliance. From there the attacker can read and modify every repository, tamper with CI/CD pipelines, exfiltrate secrets stored on the host, and pivot deeper into the enterprise network.

Root Cause

The root cause is improper input validation ([CWE-20]) in the GeoJSON configuration handler within the Management Console. The application concatenates attacker-controlled configuration values into a system command without applying an allowlist, argument array separation, or shell escaping. This pattern converts a configuration parameter into an arbitrary command execution primitive.

Attack Vector

The attack requires network access to the GHES Management Console and valid credentials for an account holding the editor role. The attacker submits a crafted GeoJSON configuration containing shell metacharacters through the Management Console interface. When GHES processes the setting, the injected command executes with the privileges of the configuration service, which is sufficient to establish admin SSH access to the appliance.

The requirement for high privileges (editor role) narrows the attacker population, but any compromise of an editor account (credential theft, phishing, insider threat) enables full appliance takeover.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-2443

Indicators of Compromise

Unexpected SSH sessions to the GHES appliance on port 122, especially from IP addresses outside the administrator allowlist.
New or modified SSH authorized keys on the appliance for the admin account.
Management Console audit log entries showing GeoJSON configuration changes with unusual characters such as ;, |, `, or $( in the submitted payload.
Configuration apply operations that spawn unexpected child processes or shells.

Detection Strategies

Review GHES audit logs (ghe-config-apply and Management Console audit events) for GeoJSON setting modifications performed by editor-role accounts.
Alert on process creation events on the appliance where the configuration service spawns interactive shells or network utilities such as bash, nc, curl, or wget.
Correlate Management Console configuration changes with subsequent SSH authentications to detect the escalation chain.

Monitoring Recommendations

Ingest GHES audit logs, syslog, and SSH authentication events into a centralized SIEM for continuous review.
Baseline normal editor-role activity and alert on deviations, such as configuration changes outside change-management windows.
Enforce alerting on any new SSH key added to the appliance and on privilege changes within the Management Console.

How to Mitigate CVE-2024-2443

Immediate Actions Required

Upgrade GitHub Enterprise Server to 3.8.17, 3.9.12, 3.10.9, 3.11.7, 3.12.1, or a later release on the corresponding branch.
Audit all Management Console accounts and remove editor-role assignments that are not strictly required.
Rotate Management Console passwords and any SSH keys installed on the appliance if unauthorized activity is suspected.
Review recent GeoJSON configuration changes for signs of exploitation.

Patch Information

GitHub released fixes in GHES 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. All versions prior to 3.13 must be upgraded to one of these patched releases. Refer to the GitHub Enterprise Server 3.12.1 Release Notes, 3.11.7 Release Notes, 3.10.9 Release Notes, 3.9.12 Release Notes, and 3.8.17 Release Notes for upgrade procedures.

Workarounds

Restrict network access to the Management Console (port 8443) to a small set of trusted administrator IP addresses using a firewall or network ACL.
Enforce multi-factor authentication for all Management Console accounts and limit the editor role to the minimum required personnel.
Restrict appliance SSH access (port 122) to authorized management networks only, blocking direct exposure to broader corporate or internet-facing segments.

bash

# Example: restrict Management Console and admin SSH access with iptables
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP
iptables -A INPUT -p tcp --dport 122 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 122 -j DROP