CVE-2024-9487: GitHub Enterprise Server Auth Bypass Flaw

CVE-2024-9487 Overview

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. This authentication bypass vulnerability (CWE-347) enables attackers with direct network access and possession of a signed SAML response or metadata document to circumvent SAML single sign-on controls when encrypted assertions are enabled.

Critical Impact

Unauthorized users can bypass SAML SSO authentication to gain access to GitHub Enterprise Server instances, potentially compromising source code repositories, CI/CD pipelines, and sensitive organizational data.

Affected Products

• GitHub Enterprise Server versions prior to 3.15
• GitHub Enterprise Server versions prior to 3.11.16
• GitHub Enterprise Server versions prior to 3.12.10, 3.13.5, and 3.14.2

Discovery Timeline

• 2024-10-10 - CVE-2024-9487 published to NVD
• 2024-11-15 - Last updated in NVD database

This vulnerability was reported via the GitHub Bug Bounty program.

Technical Details for CVE-2024-9487

Vulnerability Analysis

This vulnerability stems from improper verification of cryptographic signatures in the SAML authentication flow within GitHub Enterprise Server. When the encrypted assertions feature is enabled, the server fails to properly validate the cryptographic signature of SAML responses before processing authentication requests. This flaw allows an attacker who possesses a signed SAML response or metadata document to craft authentication requests that bypass the normal SAML SSO verification process.

The impact is significant as successful exploitation enables unauthorized user provisioning and complete access to the GitHub Enterprise Server instance, potentially exposing all repositories, secrets, and organizational data managed within the platform.

Root Cause

The root cause lies in CWE-347: Improper Verification of Cryptographic Signature. The SAML authentication implementation in affected versions of GitHub Enterprise Server does not adequately verify that cryptographic signatures on SAML assertions are valid and originate from a trusted Identity Provider. When encrypted assertions are configured, this verification gap can be exploited to forge or replay authentication tokens.

Attack Vector

Exploitation of CVE-2024-9487 requires several conditions to be met:

1. Encrypted assertions must be enabled - The vulnerability only manifests when this SAML configuration option is active
2. Direct network access - The attacker must have network connectivity to the GitHub Enterprise Server instance
3. Signed SAML artifact - The attacker needs access to a previously signed SAML response or metadata document, which could be obtained through network interception, log access, or other means

Once these prerequisites are satisfied, an attacker can submit crafted SAML authentication requests that bypass signature verification, resulting in unauthorized user provisioning and access to the instance without valid credentials from the configured Identity Provider.

Detection Methods for CVE-2024-9487

Indicators of Compromise

• Unexpected user accounts provisioned via SAML SSO that do not correspond to legitimate Identity Provider authorizations
• Authentication logs showing SAML assertions processed without corresponding Identity Provider activity
• Unusual access patterns from newly provisioned accounts accessing sensitive repositories or administrative functions
• SAML authentication requests from unexpected network sources

Detection Strategies

• Review SAML authentication logs for anomalous provisioning events, particularly users created without matching Identity Provider records
• Correlate GitHub Enterprise Server authentication events with Identity Provider logs to identify discrepancies
• Monitor for access to sensitive repositories or administrative functions from recently provisioned accounts
• Implement network monitoring to detect unauthorized access attempts to the SAML authentication endpoints

Monitoring Recommendations

• Enable detailed audit logging for all SAML SSO authentication events in GitHub Enterprise Server
• Configure alerts for new user provisioning events to enable rapid review of account creation
• Establish baseline metrics for SAML authentication patterns and alert on deviations
• Regularly audit the list of provisioned users against your Identity Provider's user directory

How to Mitigate CVE-2024-9487

Immediate Actions Required

• Upgrade GitHub Enterprise Server to patched versions immediately: 3.11.16, 3.12.10, 3.13.5, or 3.14.2 depending on your current version track
• If immediate patching is not possible, consider temporarily disabling the encrypted assertions feature in SAML configuration
• Audit all user accounts provisioned via SAML SSO to identify potentially unauthorized accounts
• Review authentication and access logs for signs of exploitation

Patch Information

GitHub has released security patches addressing CVE-2024-9487 in the following versions:

• GitHub Enterprise Server 3.11.16
• GitHub Enterprise Server 3.12.10
• GitHub Enterprise Server 3.13.5
• GitHub Enterprise Server 3.14.2

Organizations should upgrade to the appropriate patched version for their current version track. All versions prior to 3.15 are affected.

Workarounds

• Temporarily disable encrypted assertions in SAML configuration until patching can be completed (this may reduce security in other aspects, so evaluate risks)
• Implement additional network segmentation to restrict access to SAML authentication endpoints
• Enable enhanced monitoring and alerting for SAML authentication events
• Consider implementing additional authentication factors outside of the SAML flow as a compensating control

# Verify your GitHub Enterprise Server version
ghe-version

# After upgrading, verify the new version
ghe-version

# Review audit logs for SAML authentication events
ghe-support-bundle -o /tmp/support-bundle.tgz