CVE-2025-11578: GitHub Enterprise Server Privilege Escalation

CVE-2025-11578 Overview

CVE-2025-11578 is a privilege escalation vulnerability in GitHub Enterprise Server (GHES). An authenticated Enterprise admin can gain root SSH access to the appliance by abusing a symbolic link escape in pre-receive hook environments [CWE-59]. By crafting a malicious repository and hook environment, an attacker replaces system binaries during hook cleanup. The replacement payload writes an attacker-controlled SSH key into the root user's authorized_keys file. This grants persistent root SSH access to the underlying appliance. The flaw was reported through the GitHub Bug Bounty program and affects all GHES releases prior to 3.19.

Critical Impact
An authenticated Enterprise admin can escalate to root SSH on the GHES appliance, achieving full control of source code, secrets, CI workflows, and tenant data.

Affected Products

GitHub Enterprise Server versions prior to 3.14.20
GitHub Enterprise Server versions prior to 3.15.15, 3.16.11, and 3.17.8
GitHub Enterprise Server versions prior to 3.18.2

Discovery Timeline

2025-11-10 - CVE-2025-11578 published to NVD
2025-12-08 - Last updated in NVD database

Technical Details for CVE-2025-11578

Vulnerability Analysis

GitHub Enterprise Server supports pre-receive hooks, server-side scripts that run inside a sandboxed environment whenever a user pushes to a repository. To execute these hooks, GHES stages a temporary chroot-like environment containing repository contents and supporting binaries. After the hook completes, GHES tears down that environment by removing files and directories created during setup. The cleanup routine follows symbolic links it should not follow. An admin who can configure both a repository and a pre-receive hook environment plants symlinks that redirect cleanup or pre-execution operations to system locations outside the sandbox. This allows the attacker to overwrite a binary trusted by privileged appliance code. When that binary is later invoked as root, the planted payload writes an attacker SSH public key to /root/.ssh/authorized_keys, completing the escalation.

Root Cause

The root cause is improper handling of symbolic links during pre-receive hook environment management, classified as [CWE-59] Improper Link Resolution Before File Access. File operations performed by privileged GHES code do not validate that target paths remain within the intended sandbox directory, enabling a symlink escape.

Attack Vector

Exploitation requires authenticated Enterprise admin privileges, which limits the attacker pool but is well within reach of insider threats or attackers who have already compromised an admin account. The attacker uploads a custom pre-receive hook environment, pushes a crafted repository that triggers hook execution, and waits for the cleanup phase to follow planted symlinks. After binary replacement, the next privileged invocation writes the attacker SSH key, allowing direct ssh root@appliance access.

No public proof-of-concept code is available. Refer to the GitHub Enterprise Release Notes 3.18.2 for vendor technical detail.

Detection Methods for CVE-2025-11578

Indicators of Compromise

Unexpected entries in /root/.ssh/authorized_keys on the GHES appliance, particularly keys not provisioned by configured administrators.
New or modified pre-receive hook environments uploaded shortly before anomalous SSH activity on the appliance.
Successful SSH logins to the appliance from source IPs that do not match the administrator jump host or management network.
Modification timestamps on system binaries under hook execution paths that do not align with a known GHES upgrade window.

Detection Strategies

Monitor GHES audit logs for pre_receive_environment.create and pre_receive_environment.update events correlated with administrator account activity.
Baseline and alert on changes to /root/.ssh/authorized_keys and to binaries inside the pre-receive hook runtime directory.
Inspect Git push events for repositories that contain symlinks pointing outside the working tree, especially during pre-receive hook testing.

Monitoring Recommendations

Forward GHES system logs, audit logs, and SSH authentication logs to a central analytics platform for correlation across admin actions and appliance logins.
Enable file integrity monitoring on the GHES appliance for /root/.ssh/, /etc/ssh/, and hook environment directories.
Review the list of Enterprise admins quarterly and remove dormant accounts to reduce the population capable of exploiting this flaw.

How to Mitigate CVE-2025-11578

Immediate Actions Required

Upgrade GHES to a fixed release: 3.14.20, 3.15.15, 3.16.11, 3.17.8, or 3.18.2, depending on the deployed major version.
Audit /root/.ssh/authorized_keys on every GHES node and remove any key that cannot be attributed to an authorized administrator.
Review the Enterprise admin roster and audit all recent pre-receive hook environment changes for unexpected uploads.
Rotate any credentials, deploy keys, or secrets stored on the appliance if compromise is suspected.

Patch Information

GitHub released fixes in GHES 3.14.20, 3.15.15, 3.16.11, 3.17.8, and 3.18.2. Detailed change information is available in the GitHub Enterprise Release Notes 3.14.20, 3.15.15, 3.16.11, 3.17.8, and 3.18.2. All versions prior to 3.19 are affected, so administrators on older feature branches should plan an upgrade path.

Workarounds

Restrict Enterprise admin privileges to the minimum set of personnel and enforce hardware-backed multi-factor authentication for all admin accounts.
Disable or tightly restrict the use of custom pre-receive hook environments until patching is complete.
Place the GHES appliance management interface behind a bastion host and restrict SSH access by source IP allowlist.
Treat the appliance as a tier-0 asset and apply privileged access workstation requirements to any administrator interacting with it.

bash

# Verify the running GHES version on the appliance
ghe-version

# After patching, audit root authorized_keys for unauthorized entries
sudo cat /root/.ssh/authorized_keys

# List configured pre-receive hook environments via the admin API
curl -u <admin>:<token> \
  https://<ghes-host>/api/v3/admin/pre-receive-environments