CVE-2024-4985 Auth bypass in Enterprise Server

Critical 10.0 Published 20 May 2024 Updated 1 Aug 2024

Attackers can bypass authentication via forged SAML responses to gain site administrator privileges in GitHub Enterprise Server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-4985?

CVE-2024-4985 is a critical authentication bypass vulnerability in Github Enterprise Server, published on 20 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional encrypted assertions feature. This vulnerability allowed an attacker to forge a SAML response to provision and/or gain access to a user with site administrator privileges. Exploitation of this vulnerability would allow unauthorized access to the instance without requiring prior authentication. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13.0 and was fixed in versions 3.9.15, 3.10.12, 3.11.10 and 3.12.4. This vulnerability was reported via the GitHub Bug Bounty program.

Weakness: CWE-303

Which versions are affected by CVE-2024-4985?

It affects 1 product.

Products include Github Enterprise Server.

How do I fix CVE-2024-4985?

No fix has been published for CVE-2024-4985 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-4985 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4985 exists.

All Github Enterprise Server vulnerabilities

Sources

Also known as GHSA-5pw9-f9r4-mv2r.