CVE-2024-7711: GitHub Enterprise Server Auth Bypass Issue

CVE-2024-7711 Overview

An Incorrect Authorization vulnerability (CWE-863) was identified in GitHub Enterprise Server that allows an attacker to update the title, assignees, and labels of any issue inside a public repository. This authorization bypass vulnerability enables unauthorized modification of issue metadata without proper access controls, potentially leading to confusion, misdirection of development efforts, and manipulation of project tracking systems.

Critical Impact
Attackers with low-level privileges can manipulate issue metadata in public repositories, potentially disrupting project management workflows, misdirecting assignees, and altering issue categorization through label modifications.

Affected Products

GitHub Enterprise Server versions before 3.14
GitHub Enterprise Server versions 3.11.x (prior to 3.11.14)
GitHub Enterprise Server versions 3.12.x (prior to 3.12.8)
GitHub Enterprise Server versions 3.13.x (prior to 3.13.3)

Discovery Timeline

2024-08-20 - CVE-2024-7711 published to NVD
2024-09-27 - Last updated in NVD database

Technical Details for CVE-2024-7711

Vulnerability Analysis

This vulnerability stems from an Incorrect Authorization flaw (CWE-863) in GitHub Enterprise Server's issue management functionality. The vulnerability allows authenticated users to bypass authorization checks and modify issue properties (title, assignees, and labels) on public repositories where they would not normally have write access. The attack requires network access and low-privilege authentication, meaning any authenticated GitHub Enterprise Server user could potentially exploit this to manipulate issues across public repositories hosted on the affected instance.

The exploitation is limited to public repositories, which somewhat constrains the attack surface. However, for organizations hosting sensitive open-source projects or using public repositories for community engagement, this vulnerability poses a significant risk to project integrity and workflow management.

Root Cause

The root cause is an Incorrect Authorization implementation (CWE-863) in the issue management API or web interface of GitHub Enterprise Server. The authorization logic fails to properly validate whether the authenticated user has the appropriate permissions to modify issue metadata before allowing title, assignee, and label modifications. This bypass allows users who can view a public repository to also modify issue properties without having write access.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user with low-level privileges. An attacker would need to:

Have valid authentication credentials for the target GitHub Enterprise Server instance
Identify a public repository on the instance
Submit requests to modify issue titles, assignees, or labels
The server incorrectly authorizes these requests despite lacking proper write permissions

The attack does not require user interaction and can be performed programmatically via the GitHub API or web interface. While no verified proof-of-concept code is publicly available, the exploitation mechanism involves standard API calls or form submissions to the issue modification endpoints with manipulated authorization context.

Detection Methods for CVE-2024-7711

Indicators of Compromise

Unexpected modifications to issue titles, assignees, or labels in public repositories
Audit log entries showing issue modifications by users without write access to the repository
Pattern of issue metadata changes from users who are not repository collaborators
Anomalous API activity targeting issue endpoints from accounts with limited repository permissions

Detection Strategies

Review GitHub Enterprise Server audit logs for issue modification events and correlate with user permission levels
Monitor for API requests to issue update endpoints from users who lack write access to the target repository
Implement alerts for bulk or automated issue modifications that bypass normal workflow patterns
Enable enhanced audit logging for repository administration events

Monitoring Recommendations

Configure real-time alerting on GitHub Enterprise Server audit logs for issue modification anomalies
Implement regular permission audits to identify unauthorized issue changes
Monitor repository activity dashboards for unexpected patterns in issue management
Establish baseline activity patterns for public repositories to detect deviations

How to Mitigate CVE-2024-7711

Immediate Actions Required

Upgrade GitHub Enterprise Server to patched versions immediately: 3.11.14, 3.12.8, 3.13.3, or 3.14 and later
Review audit logs for evidence of exploitation since the vulnerability was disclosed
Verify integrity of issue metadata in critical public repositories
Consider temporarily restricting access to sensitive public repositories until patching is complete

Patch Information

GitHub has released security patches addressing this vulnerability in multiple supported versions. Organizations should update to one of the following fixed versions based on their current deployment:

Note: GitHub Enterprise Server version 3.10 is not affected by this vulnerability. This vulnerability was reported via the GitHub Bug Bounty program.

Workarounds

Convert sensitive public repositories to private temporarily until patches can be applied
Implement additional monitoring and alerting on issue modification events through third-party tools
Review and tighten organization-level policies for repository visibility settings
Enable branch protection and require pull request reviews to maintain oversight of repository changes

bash

# Verify current GitHub Enterprise Server version
ghe-version

# Check for available updates
ghe-upgrade -s

# Apply the security update (example for 3.13.3)
ghe-upgrade github-enterprise-3.13.3.pkg