.. / CVE-2024-0200

Exploit for GitHub Enterprise < 3.12 - Authenticated Remote Code Execution (CVE-2024-0200)

Description:

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3.

Affected Products:

GitHub Enterprise Server < 3.12 (fixed in 3.8.13, 3.9.8, 3.10.5, and 3.11.3)

Proof of Concept

PoC exploits

https://starlabs.sg/blog/2024/04-sending-myself-github-com-environment-variables-and-ghes-shell/

Nuclei Template

View the template here CVE-2024-0200.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-0200.yaml

References:

https://starlabs.sg/blog/2024/04-sending-myself-github-com-environment-variables-and-ghes-shell/
https://blog.convisoappsec.com/en/analysis-of-github-enterprise-vulnerabilities-cve-2024-0507-cve-2024-0200/
https://docs.github.com/en/[email protected]/admin/release-notes#3.10.5
https://docs.github.com/en/[email protected]/admin/release-notes#3.11.3
https://docs.github.com/en/[email protected]/admin/release-notes#3.8.13

.. / CVE-2024-0200 if(localStorage["style"]=="true"){ document.getElementById('pagestyle').setAttribute('href','/assets/styleDark.css'); document.querySelector('input[type="checkbox"]').checked = true }