CVE-2024-4985: GitHub Enterprise Server Auth Bypass Flaw

CVE-2024-4985 Overview

An authentication bypass vulnerability was discovered in GitHub Enterprise Server (GHES) affecting installations configured with SAML single sign-on (SSO) authentication when the optional encrypted assertions feature is enabled. This vulnerability allows an attacker to forge a SAML response to provision and/or gain access to a user account with site administrator privileges, enabling complete compromise of the GHES instance without requiring prior authentication.

Critical Impact

This vulnerability enables unauthenticated attackers to forge SAML responses and gain site administrator access to GitHub Enterprise Server instances, potentially compromising all source code repositories, secrets, and CI/CD pipelines managed by the platform.

Affected Products

• GitHub Enterprise Server versions prior to 3.9.15
• GitHub Enterprise Server versions 3.10.x prior to 3.10.12
• GitHub Enterprise Server versions 3.11.x prior to 3.11.10
• GitHub Enterprise Server versions 3.12.x prior to 3.12.4

Discovery Timeline

• 2024-05-20 - CVE-2024-4985 published to NVD
• 2025-08-27 - Last updated in NVD database

Technical Details for CVE-2024-4985

Vulnerability Analysis

This authentication bypass vulnerability (CWE-303: Incorrect Implementation of Authentication Algorithm) exists in the SAML authentication flow of GitHub Enterprise Server when encrypted assertions are configured. The flaw allows attackers to craft malicious SAML responses that the server incorrectly validates, bypassing the authentication mechanism entirely.

The vulnerability is particularly severe because it requires no prior authentication and can be exploited remotely over the network. Successful exploitation grants the attacker site administrator privileges, which represents complete control over the GitHub Enterprise Server instance. This includes access to all repositories, user data, organization settings, and the ability to execute arbitrary code through GitHub Actions or other CI/CD integrations.

Root Cause

The root cause stems from an incorrect implementation of the authentication algorithm in the SAML response validation process. When encrypted assertions are enabled, the GHES authentication handler fails to properly verify the authenticity and integrity of certain elements in the SAML response. This allows an attacker to construct a forged SAML assertion that the server accepts as legitimate, effectively bypassing the entire authentication mechanism.

Attack Vector

The attack is network-based and can be executed by an unauthenticated remote attacker. The exploitation flow involves:

1. The attacker identifies a GitHub Enterprise Server instance configured with SAML SSO and encrypted assertions
2. The attacker crafts a malicious SAML response containing forged assertions
3. The forged response includes claims for a user with site administrator privileges
4. The attacker submits the crafted SAML response to the GHES authentication endpoint
5. Due to improper validation, GHES accepts the forged response and grants administrator access

The attack requires no user interaction and can be performed without any prior access to the target system. Once the attacker gains administrator access, they have full control over the GHES instance, including the ability to access private repositories, modify user permissions, and potentially pivot to other connected systems.

Detection Methods for CVE-2024-4985

Indicators of Compromise

• Unexpected SAML authentication events, particularly for administrator accounts that were not initiated by legitimate users
• New administrator accounts created without proper provisioning workflows
• Unusual login patterns for site administrator accounts, especially from unexpected IP addresses or geographic locations
• SAML assertion logs showing irregularities in assertion structure or timing
• Audit log entries indicating administrative actions performed outside normal business hours or by accounts with no prior activity

Detection Strategies

• Review GHES audit logs for authentication events with suspicious SAML assertions or unusual administrator account provisioning
• Monitor for new site administrator accounts that bypass normal HR or identity provisioning processes
• Implement network-level monitoring for unusual traffic patterns to SAML authentication endpoints
• Configure alerting for any administrative account creation or privilege elevation events

Monitoring Recommendations

• Enable comprehensive audit logging on GitHub Enterprise Server instances
• Implement SIEM integration to correlate SAML authentication events with identity provider logs
• Monitor for discrepancies between identity provider authentication logs and GHES authentication events
• Establish baseline behavior for administrator account activity and alert on deviations

How to Mitigate CVE-2024-4985

Immediate Actions Required

• Upgrade GitHub Enterprise Server to a patched version immediately: 3.9.15, 3.10.12, 3.11.10, 3.12.4, or 3.13.0 or later
• If immediate patching is not possible, consider temporarily disabling SAML encrypted assertions as a workaround
• Audit all site administrator accounts and review recent authentication events for signs of compromise
• Review audit logs for any unauthorized administrative actions that may have occurred

Patch Information

GitHub has released security patches addressing this vulnerability in the following versions:

• GitHub Enterprise Server 3.9.15
• GitHub Enterprise Server 3.10.12
• GitHub Enterprise Server 3.11.10
• GitHub Enterprise Server 3.12.4

Organizations should prioritize upgrading to the latest patched version for their release branch. This vulnerability was reported through the GitHub Bug Bounty program.

Workarounds

• Temporarily disable the encrypted assertions feature in SAML SSO configuration until patching can be completed
• Implement additional network-level access controls to restrict access to the GHES authentication endpoints
• Enable IP allowlisting for administrative access if available in your GHES configuration
• Consider temporarily restricting SAML authentication to known, trusted identity provider IP ranges

# Check current GHES version
ghe-version

# After downloading the appropriate upgrade package, apply the patch
ghe-upgrade /path/to/github-enterprise-3.12.4.pkg

# Verify the upgrade was successful
ghe-version