CVE-2024-6800: GitHub Enterprise Server Auth Bypass Flaw

CVE-2024-6800 Overview

An XML signature wrapping vulnerability exists in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers that utilize publicly exposed signed federation metadata XML. This critical authentication bypass vulnerability allows an attacker with direct network access to GitHub Enterprise Server to forge a SAML response, enabling them to provision and/or gain access to a user account with site administrator privileges without requiring prior authentication.

Critical Impact

Attackers can forge SAML responses to gain unauthorized administrator access to GitHub Enterprise Server instances, potentially compromising all repositories, secrets, and organizational data.

Affected Products

• GitHub Enterprise Server versions prior to 3.14
• GitHub Enterprise Server versions 3.10.x prior to 3.10.16
• GitHub Enterprise Server versions 3.11.x prior to 3.11.14
• GitHub Enterprise Server versions 3.12.x prior to 3.12.8
• GitHub Enterprise Server versions 3.13.x prior to 3.13.3

Discovery Timeline

• 2024-08-20 - CVE-2024-6800 published to NVD
• 2024-09-30 - Last updated in NVD database

Technical Details for CVE-2024-6800

Vulnerability Analysis

This vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature), representing a fundamental flaw in how GitHub Enterprise Server validates SAML authentication responses. XML Signature Wrapping (XSW) attacks exploit weaknesses in XML signature validation logic, allowing attackers to manipulate the structure of a signed XML document while preserving the validity of the signature.

In this case, the vulnerability manifests when GHES is configured with SAML authentication using identity providers that expose signed federation metadata XML publicly. The flaw allows attackers to craft malicious SAML responses that pass signature verification while containing attacker-controlled assertions about user identity and privileges.

The attack requires direct network access to the GitHub Enterprise Server instance but does not require any prior authentication, making it particularly dangerous for internet-exposed deployments.

Root Cause

The root cause lies in improper verification of cryptographic signatures within the SAML authentication flow. Specifically, the vulnerability exists because the signature validation process does not properly bind the signature to the specific XML elements that define user identity and permissions. This allows an attacker to wrap or relocate signed portions of the XML document while injecting malicious content that gets processed by the application.

Attack Vector

The attack vector is network-based, requiring an attacker to have direct network connectivity to the vulnerable GitHub Enterprise Server instance. The attacker exploits the SAML authentication endpoint by submitting a crafted SAML response that:

1. Contains valid cryptographic signatures from the legitimate identity provider's publicly available federation metadata
2. Manipulates the XML structure to inject forged assertions about user identity
3. Claims site administrator privileges for the attacker's provisioned account

The vulnerability allows complete authentication bypass without requiring any legitimate credentials or prior access to the system. Successful exploitation grants the attacker full administrative control over the GitHub Enterprise Server instance.

Detection Methods for CVE-2024-6800

Indicators of Compromise

• Unexpected administrator account creation in GHES audit logs
• SAML authentication events from unusual source IP addresses or at abnormal times
• New user accounts with site administrator privileges that were not provisioned through normal HR/IT workflows
• Anomalous repository access patterns or configuration changes by recently created administrator accounts

Detection Strategies

• Monitor GHES audit logs for user provisioning events, particularly those resulting in administrator-level access
• Implement network monitoring to detect unusual traffic patterns to SAML authentication endpoints
• Review identity provider logs for authentication events that do not correlate with legitimate user activity
• Deploy web application firewall rules to detect malformed or suspicious SAML responses

Monitoring Recommendations

• Enable comprehensive audit logging for all authentication events in GitHub Enterprise Server
• Configure alerts for any new site administrator account creation
• Implement regular review of user permissions and access levels
• Monitor for access to sensitive repositories or settings by recently provisioned accounts

How to Mitigate CVE-2024-6800

Immediate Actions Required

• Upgrade GitHub Enterprise Server to a patched version immediately: 3.13.3, 3.12.8, 3.11.14, or 3.10.16
• Review GHES audit logs for any suspicious account provisioning or authentication events
• Audit all administrator accounts to verify their legitimacy
• If compromise is suspected, rotate all secrets, tokens, and credentials stored in GHES

Patch Information

GitHub has released security patches addressing this vulnerability across all supported version branches. Organizations should upgrade to the following minimum versions:

• Version 3.13.x: Upgrade to 3.13.3 or later
• Version 3.12.x: Upgrade to 3.12.8 or later
• Version 3.11.x: Upgrade to 3.11.14 or later
• Version 3.10.x: Upgrade to 3.10.16 or later

This vulnerability was reported via the GitHub Bug Bounty program.

Workarounds

• Restrict network access to GitHub Enterprise Server to trusted networks only until patching is complete
• Consider temporarily disabling SAML authentication if feasible, falling back to built-in authentication mechanisms
• Implement additional network segmentation to limit exposure of GHES authentication endpoints
• Deploy web application firewall rules to inspect and filter SAML traffic for anomalies

# Verify current GHES version
ghe-version

# Check for available updates
ghe-upgrade -s

# Apply security update (example for 3.13.3)
ghe-upgrade ghes-3.13.3.pkg