CyberRota Analysis
AI-GeneratedA Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allows attackers to execute remote code by exploiting insufficient network isolation, enabling malicious pre-receive hook code to impersonate internal services. This issue affects all versions prior to 3.22 and requires either site administrator privileges or write access to a repository with a configured pre-receive hook for exploitation. Organizations using affected versions should prioritize immediate updates to mitigate the risk of elevated code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program.
Related CVEs
Other vulnerabilities affecting the same vendor(s)