CVE-2024-2469: GitHub Enterprise Server RCE Vulnerability

CVE-2024-2469 Overview

CVE-2024-2469 is a remote code execution vulnerability in GitHub Enterprise Server (GHES). An attacker holding an Administrator role can leverage the flaw to gain SSH root access to the underlying appliance. The issue affects GHES versions 3.8.0 and above, and is fixed in 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. The vulnerability was reported through the GitHub Bug Bounty program and is categorized under [CWE-20] Improper Input Validation. Exploitation requires high privileges but yields full operating system control over the appliance hosting source code, CI/CD pipelines, and secrets.

Critical Impact
An authenticated administrator can escalate to SSH root on the GHES host, compromising code repositories, CI runners, and stored secrets across the enterprise.

Affected Products

GitHub Enterprise Server versions 3.8.0 through 3.8.16
GitHub Enterprise Server versions 3.9.0 through 3.9.11, 3.10.0 through 3.10.8, and 3.11.0 through 3.11.6
GitHub Enterprise Server version 3.12.0

Discovery Timeline

2024-03-20 - CVE-2024-2469 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2469

Vulnerability Analysis

CVE-2024-2469 is a remote code execution flaw reachable through an administrator-facing interface of GitHub Enterprise Server. Successful exploitation grants the attacker SSH root access on the appliance, converting an application-tier administrative role into full operating system compromise. Because GHES appliances host Git repositories, GitHub Actions runners, webhooks, and integration secrets, root access exposes the entire software supply chain served by the instance. The vulnerability requires the attacker to already control an Administrator account, but it removes the boundary that normally separates management-plane access from host-level access.

Root Cause

The National Vulnerability Database classifies the underlying weakness as [CWE-20] Improper Input Validation. Administrator-supplied input reaches a code path on the appliance that lacks sufficient validation, permitting execution of attacker-controlled commands in a root context. GitHub has not published the affected component in the public advisory beyond noting the fix ships in the listed patch releases.

Attack Vector

The attack vector is network-based and requires an authenticated Administrator session on the target GHES instance. No user interaction is required, and the attack complexity is low once administrator credentials are held. Because attackers frequently obtain administrator access through credential theft, phishing, or session hijacking, this vulnerability provides a direct pivot from stolen administrator credentials to root shell access on the appliance. No public proof-of-concept exploit or CISA KEV listing is currently associated with this CVE. Technical specifics beyond the vendor release notes have not been disclosed; see the GitHub Admin Release Notes 3.12.1 for the corresponding fix entry.

Detection Methods for CVE-2024-2469

Indicators of Compromise

Unexpected SSH sessions to the GHES appliance originating from non-administrative networks or from accounts not typically used for host maintenance.
New or modified files under root-owned directories such as /data, /etc, or /root outside of documented upgrade windows.
Administrator API tokens or ghe-* command-line utilities invoked from unusual client IPs shortly before SSH access is observed.

Detection Strategies

Correlate GHES audit log entries for administrator actions with sshd authentication events on the appliance to flag admin sessions followed by unexpected root logins.
Alert on changes to the appliance's SSH authorized_keys files, sudoers, or systemd unit files that are not part of an approved change ticket.
Baseline outbound network connections from the GHES host and alert on new egress destinations, which can indicate a post-exploitation command-and-control channel.

Monitoring Recommendations

Forward GHES system, audit, and sshd logs to a centralized analytics platform and retain them for at least 90 days.
Monitor administrator role assignments and privileged group membership changes in the GHES management console.
Track GHES version and patch level as a configuration item so that unpatched hosts are visible to the security team.

How to Mitigate CVE-2024-2469

Immediate Actions Required

Upgrade GitHub Enterprise Server to 3.8.17, 3.9.12, 3.10.9, 3.11.7, 3.12.1, or later.
Audit the list of accounts holding the Administrator role and remove any that are unnecessary or dormant.
Rotate SSH host keys, administrator credentials, and appliance-level secrets if the instance ran an affected version and administrator activity cannot be fully accounted for.

Patch Information

GitHub addressed CVE-2024-2469 in the following GHES releases: 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. Refer to the vendor release notes for the applicable branch: 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. Apply patches through the standard ghe-upgrade workflow after taking a configuration backup.

Workarounds

Enforce multi-factor authentication for all administrator accounts on GHES to raise the cost of obtaining the prerequisite role.
Restrict access to the GHES management console and SSH administrative port (122/tcp) to a limited jump-host network segment.
Where upgrading immediately is not possible, reduce the number of Administrator accounts to the minimum required and closely monitor their activity until the patch is applied.

bash

# Verify the running GHES version and upgrade path
ssh -p 122 admin@ghes.example.com -- ghe-version

# Stage and apply the patch package (example for 3.12 branch)
ssh -p 122 admin@ghes.example.com -- 'ghe-upgrade /home/admin/github-enterprise-3.12.1.pkg'