fkie_cve-2024-6800
Vulnerability from fkie_nvd
Published
2024-08-20 20:15
Modified
2024-09-30 19:14
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.
References
product-cna@github.comhttps://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16Release Notes, Vendor Advisory
product-cna@github.comhttps://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14Release Notes, Vendor Advisory
product-cna@github.comhttps://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8Release Notes, Vendor Advisory
product-cna@github.comhttps://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
github enterprise_server *
github enterprise_server *
github enterprise_server *
github enterprise_server *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "827A09EB-C889-49E4-982D-01B416DEA6C3",
                     versionEndExcluding: "3.10.16",
                     versionStartIncluding: "3.10.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6ECADA51-1495-4D35-B7C0-6ADED7EDD26D",
                     versionEndExcluding: "3.11.14",
                     versionStartIncluding: "3.11.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2C305C7E-C6A2-42F2-A910-203B74C71128",
                     versionEndExcluding: "3.12.8",
                     versionStartIncluding: "3.12.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3A51D9A9-389E-469F-B17C-F5B7CCEEC498",
                     versionEndExcluding: "3.13.3",
                     versionStartIncluding: "3.13.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML. This vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in versions 3.13.3, 3.12.8, 3.11.14, and 3.10.16. This vulnerability was reported via the GitHub Bug Bounty program.",
      },
      {
         lang: "es",
         value: "Había una vulnerabilidad de ajuste de firma XML en GitHub Enterprise Server (GHES) al utilizar la autenticación SAML con proveedores de identidad específicos. Esta vulnerabilidad permitió a un atacante con acceso directo a la red de GitHub Enterprise Server falsificar una respuesta SAML para aprovisionar y/u obtener acceso a un usuario con privilegios de administrador del sitio. La explotación de esta vulnerabilidad permitiría el acceso no autorizado a la instancia sin requerir autenticación previa. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.14 y se solucionó en las versiones 3.13.3, 3.12.8, 3.11.14 y 3.10.16. Esta vulnerabilidad se informó a través del programa GitHub Bug Bounty.",
      },
   ],
   id: "CVE-2024-6800",
   lastModified: "2024-09-30T19:14:50.430",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
      cvssMetricV40: [
         {
            cvssData: {
               Automatable: "NOT_DEFINED",
               Recovery: "USER",
               Safety: "NOT_DEFINED",
               attackComplexity: "HIGH",
               attackRequirements: "PRESENT",
               attackVector: "NETWORK",
               availabilityRequirement: "NOT_DEFINED",
               baseScore: 9.5,
               baseSeverity: "CRITICAL",
               confidentialityRequirement: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirement: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubAvailabilityImpact: "NOT_DEFINED",
               modifiedSubConfidentialityImpact: "NOT_DEFINED",
               modifiedSubIntegrityImpact: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnAvailabilityImpact: "NOT_DEFINED",
               modifiedVulnConfidentialityImpact: "NOT_DEFINED",
               modifiedVulnIntegrityImpact: "NOT_DEFINED",
               privilegesRequired: "NONE",
               providerUrgency: "RED",
               subAvailabilityImpact: "LOW",
               subConfidentialityImpact: "HIGH",
               subIntegrityImpact: "HIGH",
               userInteraction: "NONE",
               valueDensity: "CONCENTRATED",
               vectorString: "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:C/RE:H/U:Red",
               version: "4.0",
               vulnAvailabilityImpact: "LOW",
               vulnConfidentialityImpact: "HIGH",
               vulnIntegrityImpact: "HIGH",
               vulnerabilityResponseEffort: "HIGH",
            },
            source: "product-cna@github.com",
            type: "Secondary",
         },
      ],
   },
   published: "2024-08-20T20:15:09.910",
   references: [
      {
         source: "product-cna@github.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.16",
      },
      {
         source: "product-cna@github.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.14",
      },
      {
         source: "product-cna@github.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.8",
      },
      {
         source: "product-cna@github.com",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.3",
      },
   ],
   sourceIdentifier: "product-cna@github.com",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-347",
            },
         ],
         source: "product-cna@github.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-347",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.