CVE-2024-47910 Overview
CVE-2024-47910 affects SonarSource SonarQube versions before 9.9.5 LTA and 10.x releases before 10.5. The vulnerability allows a SonarQube user with the Administrator role to modify an existing GitHub integration configuration and exfiltrate a pre-signed JSON Web Token (JWT). The flaw maps to [CWE-284: Improper Access Control] and enables the recovery of sensitive integration credentials that were intended to remain server-side. An attacker holding administrative privileges can pivot from SonarQube into linked GitHub environments by abusing the exposed JWT.
Critical Impact
An authenticated administrator can extract a pre-signed JWT tied to a GitHub App integration, enabling unauthorized access to connected GitHub repositories and downstream CI/CD assets.
Affected Products
- SonarSource SonarQube versions prior to 9.9.5 LTA
- SonarSource SonarQube 10.x versions prior to 10.5
- SonarQube deployments with GitHub integration configured
Discovery Timeline
- 2024-10-04 - CVE-2024-47910 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47910
Vulnerability Analysis
SonarQube integrates with GitHub through a GitHub App configuration that stores credentials and issues pre-signed JWTs. These JWTs authenticate SonarQube to the GitHub API for pull request decoration, code scanning, and repository access. The vulnerability arises because the administrative configuration workflow for the GitHub integration does not sufficiently isolate the pre-signed JWT from the configuring user. An administrator editing an existing integration can trigger a code path that returns or exposes the signed token rather than keeping it server-side.
Because the exposed JWT is pre-signed with the private key of the GitHub App, an attacker can replay it against GitHub outside the SonarQube trust boundary. This turns a SonarQube administrative account into a persistent foothold in GitHub tenants that trust the integration.
Root Cause
The root cause is improper access control ([CWE-284]) around the GitHub integration configuration endpoint. Sensitive material tied to the integration, specifically a pre-signed JWT, is reachable via administrator-level modification actions instead of being restricted to backend use. The design assumed administrators were fully trusted operators of the JWT, but the token's cross-service reach makes exposure significant.
Attack Vector
Exploitation requires an authenticated user with the Administrator role on the SonarQube instance. The attacker navigates to an existing GitHub integration configuration and performs a modification that causes the pre-signed JWT to be returned or logged in a way accessible to the administrator. The attacker then uses the JWT to authenticate directly to GitHub as the SonarQube GitHub App, gaining the permissions granted to that App across installed repositories. Refer to the SonarSource Community Information Leak advisory and the tracker items SONAR-21795 and SONAR-21813 for vendor technical details.
Detection Methods for CVE-2024-47910
Indicators of Compromise
- Unexpected edits to GitHub integration configurations in SonarQube audit logs, especially from administrators outside a normal change window.
- GitHub audit log entries showing GitHub App authentication from IP addresses or user agents that do not match the SonarQube server.
- New or unexplained GitHub App installation token requests correlated with SonarQube administrative sessions.
Detection Strategies
- Correlate SonarQube administrator activity with GitHub App API calls to identify JWT reuse from unexpected sources.
- Alert on modifications to ALM (Application Lifecycle Management) integration settings in SonarQube, focusing on the GitHub provider.
- Monitor for the presence of raw JWT strings in HTTP responses returned by SonarQube administrative endpoints.
Monitoring Recommendations
- Enable and centrally forward SonarQube audit logs and GitHub organization audit logs to a SIEM for cross-source correlation.
- Track GitHub App installation token issuance and repository access events tied to the SonarQube integration.
- Review administrator role assignments in SonarQube on a recurring basis and remove stale accounts.
How to Mitigate CVE-2024-47910
Immediate Actions Required
- Upgrade SonarQube to 9.9.5 LTA or 10.5 or later.
- Rotate the private key of the GitHub App used by the SonarQube integration and revoke any active installation tokens.
- Audit SonarQube administrator accounts and remove any that are not strictly required.
- Review GitHub organization audit logs for anomalous GitHub App activity since the integration was configured.
Patch Information
SonarSource has released fixed versions: SonarQube 9.9.5 LTA for the 9.x LTA branch and SonarQube 10.5 for the 10.x branch. Administrators should apply the patched version and follow the guidance in the SonarSource Community advisory and the associated tracker items SONAR-21795 and SONAR-21813.
Workarounds
- Restrict the Administrator role to a minimal, closely monitored set of accounts and enforce multi-factor authentication for those users.
- Temporarily disable the GitHub integration if patching cannot be performed immediately and JWT exposure is a concern.
- Scope the GitHub App to the least privilege necessary across repositories to reduce impact if a JWT is exfiltrated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
