CVE-2024-1482 (GCVE-0-2024-1482)
Vulnerability from cvelistv5 – Published: 2024-02-14 20:04 – Updated: 2024-08-01 18:40
VLAI?
Title
Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution
Summary
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.
Severity ?
7.1 (High)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| GitHub | Enterprise Server |
Affected:
3.9.0 , < 3.9.9
(semver)
Affected: 3.10.0 , < 3.10.6 (semver) Affected: 3.11.0 , < 3.11.4 (semver) |
Credits
ahacker1
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-1482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-15T19:52:09.794469Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:00:04.297Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T18:40:21.100Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10"
},
{
"tags": [
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7"
},
{
"tags": [
"x_transferred"
],
"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Enterprise Server",
"vendor": "GitHub",
"versions": [
{
"changes": [
{
"at": "3.9.10",
"status": "unaffected"
}
],
"lessThan": "3.9.9",
"status": "affected",
"version": "3.9.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.10.7",
"status": "unaffected"
}
],
"lessThan": "3.10.6",
"status": "affected",
"version": "3.10.0",
"versionType": "semver"
},
{
"changes": [
{
"at": "3.11.5",
"status": "unaffected"
}
],
"lessThan": "3.11.4",
"status": "affected",
"version": "3.11.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "ahacker1"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.\u003cbr\u003e"
}
],
"value": "An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-14T20:04:47.981Z",
"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
"shortName": "GitHub_P"
},
"references": [
{
"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10"
},
{
"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7"
},
{
"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution ",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760",
"assignerShortName": "GitHub_P",
"cveId": "CVE-2024-1482",
"datePublished": "2024-02-14T20:04:47.981Z",
"dateReserved": "2024-02-13T20:04:24.216Z",
"dateUpdated": "2024-08-01T18:40:21.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.\\n\"}, {\"lang\": \"es\", \"value\": \"Se identific\\u00f3 una vulnerabilidad de autorizaci\\u00f3n incorrecta en GitHub Enterprise Server que permiti\\u00f3 a un atacante crear nuevas sucursales en repositorios p\\u00fablicos y ejecutar flujos de trabajo arbitrarios de GitHub Actions con permisos de GITHUB_TOKEN. Para aprovechar esta vulnerabilidad, un atacante necesitar\\u00eda acceso al servidor empresarial. Esta vulnerabilidad afect\\u00f3 a todas las versiones de GitHub Enterprise Server posteriores a la 3.8 y anteriores a la 3.12, y se solucion\\u00f3 en las versiones 3.9.10, 3.10.7, 3.11.5. Esta vulnerabilidad se inform\\u00f3 a trav\\u00e9s del programa GitHub Bug Bounty.\"}]",
"id": "CVE-2024-1482",
"lastModified": "2024-11-21T08:50:40.710",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"product-cna@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 4.2}]}",
"published": "2024-02-14T20:15:45.690",
"references": "[{\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10\", \"source\": \"product-cna@github.com\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "product-cna@github.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"product-cna@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-1482\",\"sourceIdentifier\":\"product-cna@github.com\",\"published\":\"2024-02-14T20:15:45.690\",\"lastModified\":\"2025-01-23T19:53:54.957\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.\\n\"},{\"lang\":\"es\",\"value\":\"Se identific\u00f3 una vulnerabilidad de autorizaci\u00f3n incorrecta en GitHub Enterprise Server que permiti\u00f3 a un atacante crear nuevas sucursales en repositorios p\u00fablicos y ejecutar flujos de trabajo arbitrarios de GitHub Actions con permisos de GITHUB_TOKEN. Para aprovechar esta vulnerabilidad, un atacante necesitar\u00eda acceso al servidor empresarial. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server posteriores a la 3.8 y anteriores a la 3.12, y se solucion\u00f3 en las versiones 3.9.10, 3.10.7, 3.11.5. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"product-cna@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.8.0\",\"versionEndExcluding\":\"3.9.10\",\"matchCriteriaId\":\"87AFBB5E-CCD3-4C54-8813-8D4ABF12C3E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.0\",\"versionEndExcluding\":\"3.10.7\",\"matchCriteriaId\":\"EB406BB2-7ABF-4A44-830F-7012CDB3D81D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.11.0\",\"versionEndExcluding\":\"3.11.5\",\"matchCriteriaId\":\"0529566C-AC2F-4385-93D7-578230AC453E\"}]}]}],\"references\":[{\"url\":\"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10\",\"source\":\"product-cna@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T18:40:21.100Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-1482\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-02-15T19:52:09.794469Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:10.880Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution \", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"ahacker1\"}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"GitHub\", \"product\": \"Enterprise Server\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"3.9.10\", \"status\": \"unaffected\"}], \"version\": \"3.9.0\", \"lessThan\": \"3.9.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.10.7\", \"status\": \"unaffected\"}], \"version\": \"3.10.0\", \"lessThan\": \"3.10.6\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"3.11.5\", \"status\": \"unaffected\"}], \"version\": \"3.11.0\", \"lessThan\": \"3.11.4\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.10\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.7\"}, {\"url\": \"https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.5\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in public repositories and run arbitrary GitHub Actions workflows with permissions from the GITHUB_TOKEN. To exploit this vulnerability, an attacker would need access to the Enterprise Server. This vulnerability affected all versions of GitHub Enterprise Server after 3.8 and prior to 3.12, and was fixed in versions 3.9.10, 3.10.7, 3.11.5. This vulnerability was reported via the GitHub Bug Bounty program.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"shortName\": \"GitHub_P\", \"dateUpdated\": \"2024-02-14T20:04:47.981Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-1482\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T18:40:21.100Z\", \"dateReserved\": \"2024-02-13T20:04:24.216Z\", \"assignerOrgId\": \"82327ea3-741d-41e4-88f8-2cf9e791e760\", \"datePublished\": \"2024-02-14T20:04:47.981Z\", \"assignerShortName\": \"GitHub_P\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…