Report feedback

Due to insufficient verification of cryptographic signatures, an authenticated remote attacker can bypass SAML and create user accounts or access the instance without authorization. The vulnerability does not affect instances that do not use SAML single sign-on, nor those where the attacker is not already an existing user [6][7]. A PoC exploit and details of the vulnerability can be found at [7][8].

The vulnerability is present in product:

• *:GitHub Enterprise Server;>=3.12,<3.12.14;>=3.13,<3.13.10;>=3.14,<3.14.7;>=3.15,<3.15.2

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

More information:

• CVE-2025-23369 at cve.org, NVD
• CWE-347: Improper Verification of Cryptographic Signature at cwe.mitre.org

The vulnerability was publicly disclosed 21. 1. 2025.

An unauthenticated remote attacker, using social engineering, can inject malicious code into a query selector via an identity attribute during message processing and exfiltrate potentially sensitive data, including authentication tokens [9].

The vulnerability is present in product:

• *:GitHub Enterprise Server;>=3.11,<3.11.17;>=3.12,<3.12.11;>=3.13,<3.13.6;>=3.14,<3.14.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

More information:

• CVE-2024-10001 at cve.org, NVD
• CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 29. 1. 2025.

An authenticated local attacker with Enterprise Administrator access to the instance can, via the "ghe-firejail" path, escape from the container, escalate privileges to root and execute code [10].

The vulnerability is present in product:

• *:GitHub Enterprise Server;>=3.11,<3.11.17;>=3.12,<3.12.11;>=3.13,<3.13.6;>=3.14,<3.14.3

CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

• CVE-2024-10007 at cve.org, NVD
• CWE-59: Improper Link Resolution Before File Access ('Link Following') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 11. 2024.