CVE-2024-5746 Overview
CVE-2024-5746 is a Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server (GHES). An attacker authenticated as a Site Administrator can leverage the flaw to gain arbitrary code execution on the GHES instance. The issue affects all GHES releases prior to 3.13 and is resolved in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. GitHub received the report through its Bug Bounty program. The vulnerability is classified under CWE-918.
Critical Impact
A Site Administrator can pivot from privileged web access into full code execution on the underlying GitHub Enterprise Server appliance, exposing source code repositories, secrets, and CI/CD infrastructure.
Affected Products
- GitHub Enterprise Server versions prior to 3.9.16
- GitHub Enterprise Server 3.10.x prior to 3.10.13 and 3.11.x prior to 3.11.11
- GitHub Enterprise Server 3.12.x prior to 3.12.5
Discovery Timeline
- 2024-06-20 - CVE-2024-5746 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5746
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery flaw reachable through functionality available to accounts holding the Site Administrator role. The Site Administrator role in GHES is intended for appliance operators, so any escape from its web boundary into code execution collapses the trust model between the management plane and the host. Because SSRF permits the server to be coerced into issuing requests on behalf of the attacker, the flaw allowed the attacker to reach internal services or endpoints that ultimately yielded arbitrary code execution on the appliance.
Root Cause
The root cause is insufficient validation of URLs or destination addresses used by a server-side request handler accessible to Site Administrators. The application accepts an attacker-controllable target and issues an outbound request without adequately restricting the destination to safe, external hosts. This permits requests to loopback, link-local, or internal management endpoints on the GHES appliance itself, which are used to reach functionality that executes attacker-supplied logic.
Attack Vector
Exploitation requires network access to the GHES web interface or API and authentication as a Site Administrator. The attacker directs the vulnerable feature to make a request to an internal endpoint under their influence and chains the SSRF into code execution on the host. Detailed exploitation mechanics were not published by GitHub. Refer to the GitHub Enterprise Server 3.12.5 release notes for advisory-level details.
Detection Methods for CVE-2024-5746
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the GHES appliance targeting 127.0.0.1, 169.254.169.254, or other internal management addresses.
- New or modified files, cron entries, or services on the GHES host that do not correspond to a documented upgrade or configuration change.
- Site Administrator sessions performing configuration-adjacent API calls at unusual times or from unfamiliar source IP addresses.
Detection Strategies
- Audit ghe-audit-log entries and admin console logs for Site Administrator actions that invoke features accepting URLs or hostnames as parameters.
- Compare running GHES version against fixed builds 3.9.16, 3.10.13, 3.11.11, and 3.12.5 using ghe-version or the management console.
- Correlate authenticated admin activity with subsequent outbound network flows from the appliance to internal RFC1918 or loopback destinations.
Monitoring Recommendations
- Enable and forward GHES audit logs and system logs to a centralized SIEM for retention and correlation.
- Alert on process execution, shell spawns, or package installations on the GHES host outside of scheduled maintenance windows.
- Monitor changes to the Site Administrator user set and enforce alerting on privilege grants.
How to Mitigate CVE-2024-5746
Immediate Actions Required
- Upgrade GitHub Enterprise Server to 3.12.5, 3.11.11, 3.10.13, or 3.9.16 as appropriate for your release train.
- Review the current list of Site Administrator accounts and remove any that are no longer required.
- Enforce multi-factor authentication and, where possible, restrict administrative access to a bastion network segment.
Patch Information
GitHub has released fixed builds. Consult the release notes for each supported branch: 3.9.16, 3.10.13, 3.11.11, and 3.12.5. Apply the corresponding hotpatch or full upgrade using the GHES management console.
Workarounds
- Restrict administrative console and API access to a small set of trusted source IP addresses using network ACLs or a reverse proxy.
- Rotate credentials, personal access tokens, and SSH keys for Site Administrator accounts and enforce short session lifetimes until patching is complete.
- Limit egress from the GHES appliance so that outbound traffic can only reach explicitly required destinations, reducing SSRF impact.
# Verify installed GHES version and apply the hotpatch after download
ssh -p 122 admin@ghes.example.com -- 'ghe-version'
ssh -p 122 admin@ghes.example.com -- 'ghe-upgrade /home/admin/github-enterprise-3.12.5.hpkg'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
