CVE-2025-3509: GitHub Enterprise Server RCE Vulnerability

CVE-2025-3509 Overview

A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allows attackers to execute arbitrary code by exploiting the pre-receive hook functionality. This vulnerability can lead to privilege escalation and complete system compromise of affected GitHub Enterprise Server installations.

The vulnerability involves using dynamically allocated ports that become temporarily available during specific operational conditions, such as hot patch upgrades. This time-limited attack window restricts exploitation opportunities but still presents significant risk when conditions align.

Critical Impact

Attackers with site administrator permissions or repository modification rights can execute arbitrary code on GitHub Enterprise Server, potentially compromising source code repositories, CI/CD pipelines, and sensitive enterprise data.

Affected Products

• GitHub Enterprise Server versions prior to 3.18
• GitHub Enterprise Server versions prior to 3.17.1
• GitHub Enterprise Server versions prior to 3.16.4, 3.15.8, 3.14.13, and 3.13.16

Discovery Timeline

• April 17, 2025 - CVE-2025-3509 published to NVD
• September 5, 2025 - Last updated in NVD database

Technical Details for CVE-2025-3509

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw resides in the pre-receive hook functionality of GitHub Enterprise Server, which is designed to enforce policies and run automated checks before accepting repository pushes.

The core issue involves dynamically allocated ports that temporarily become available during specific server operations, particularly hot patch upgrades. When these ports are exposed, an attacker can exploit the pre-receive hook mechanism to inject and execute arbitrary code on the server.

Exploitation requires elevated privileges—either site administrator permissions to enable and configure pre-receive hooks, or sufficient repository permissions where pre-receive hooks are already enabled. This privilege requirement provides some mitigation, but insider threats or compromised administrator accounts significantly increase risk.

Root Cause

The vulnerability stems from improper handling of dynamically allocated network ports during server maintenance operations. When GitHub Enterprise Server performs hot patch upgrades, certain ports become temporarily available, creating a window where the pre-receive hook functionality can be abused to execute malicious code. The code injection flaw allows attackers to bypass intended security controls when these conditions are met.

Attack Vector

The attack is network-based and requires the attacker to have specific permissions within the GitHub Enterprise Server environment. The exploitation path involves:

1. The attacker must have either site administrator permissions to configure pre-receive hooks, or permissions to modify repositories where pre-receive hooks are already enabled
2. The attacker monitors for or triggers conditions where dynamically allocated ports become available (such as during hot patch operations)
3. During this window, the attacker crafts malicious input through the pre-receive hook mechanism
4. The vulnerable code processes this input, leading to arbitrary code execution with elevated privileges

The attack requires precise timing alignment with server maintenance windows, which limits the practical exploitation window but does not eliminate the risk.

Detection Methods for CVE-2025-3509

Indicators of Compromise

• Unexpected modifications to pre-receive hook configurations or scripts
• Unusual network activity on dynamically allocated ports during maintenance windows
• Anomalous process execution originating from the GitHub Enterprise Server application
• Unauthorized changes to repository settings or hook permissions
• Log entries indicating code execution from pre-receive hook contexts outside normal operations

Detection Strategies

• Monitor audit logs for changes to pre-receive hook configurations and permissions
• Implement network monitoring to detect unusual port activity during hot patch operations
• Review administrator account activity for unauthorized hook modifications
• Deploy endpoint detection to identify suspicious process chains from the GHES application
• Establish baseline behavior for pre-receive hook execution patterns to detect anomalies

Monitoring Recommendations

• Enable comprehensive audit logging for all administrative actions on GitHub Enterprise Server
• Configure alerts for pre-receive hook configuration changes across all repositories
• Monitor system processes for unexpected code execution during maintenance windows
• Implement network segmentation to limit exposure of dynamically allocated ports
• Review access logs regularly for site administrator and privileged repository accounts

How to Mitigate CVE-2025-3509

Immediate Actions Required

• Upgrade GitHub Enterprise Server to patched versions immediately: 3.17.1, 3.16.4, 3.15.8, 3.14.13, or 3.13.16
• Audit all pre-receive hook configurations across the enterprise environment
• Review and restrict site administrator permissions to essential personnel only
• Monitor for suspicious activity during any maintenance or upgrade operations
• Consider temporarily disabling pre-receive hooks until patching is complete

Patch Information

GitHub has released security patches addressing this vulnerability. Organizations should upgrade to one of the following fixed versions based on their current version branch:

• Version 3.17.1 - GitHub Enterprise Release Notes 3.17.1
• Version 3.16.4 - GitHub Enterprise Release Notes 3.16.4
• Version 3.15.8 - GitHub Enterprise Release Notes 3.15.8
• Version 3.14.13 - GitHub Enterprise Release Notes 3.14.13
• Version 3.13.16 - GitHub Enterprise Release Notes 3.13.16

This vulnerability was reported through the GitHub Bug Bounty program.

Workarounds

• Restrict pre-receive hook configuration to only essential administrators
• Disable pre-receive hooks on repositories where they are not strictly required
• Schedule hot patch operations during low-activity periods with enhanced monitoring
• Implement additional network controls to limit access during maintenance windows
• Apply principle of least privilege for all repository modification permissions

# Review pre-receive hooks configuration
ghe-hook-list --pre-receive

# Audit administrator access
ghe-org-admin-promote --list

# Check current version
ghe-version