CVE-2024-1355
published 2024-02-13CVE-2024-1355: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
PriorityP260critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
2.36%
81.7th percentile
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | enterprise_server | < 3.8.15 | 3.8.15 |
| github | enterprise_server | >= 3.10.0 < 3.10.7 | 3.10.7 |
| github | enterprise_server | >= 3.11.0 < 3.11.5 | 3.11.5 |
| github | enterprise_server | >= 3.8.0 < 3.8.15 | 3.8.15 |
| github | enterprise_server | >= 3.9.0 < 3.9.10 | 3.9.10 |
Detection & IOCsextracted from sources · hover to see the quote
- →Command injection occurs when an attacker with Management Console editor role sets a service URL in the actions-console docker container, resulting in admin SSH access to the appliance ↗
- →Monitor for unexpected SSH sessions to the GitHub Enterprise Server appliance originating from or associated with the actions-console docker container process ↗
- →Audit Management Console activity for editor-role accounts modifying service URL fields, which is the injection point for this vulnerability ↗
- ·Vulnerability affects all GitHub Enterprise Server versions prior to 3.12; patched versions are 3.11.5, 3.10.7, 3.9.10, and 3.8.15 — detection efforts should prioritize unpatched instances ↗
- ·Exploitation requires two preconditions: network access to the GHES instance AND a Management Console account with the editor role — both must be present for the attack chain to succeed ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6r4c-h9mj-c94g: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to
ghsa_unreviewed·2024-02-13
CVE-2024-1355 [CRITICAL] CWE-20 GHSA-6r4c-h9mj-c94g: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15. This vulnerability was reported via the GitHub Bug Bounty program.
Red Hat
kernel: Bluetooth: ISO: Check socket flag instead of hcon
vendor_redhat·2024-07-30·CVSS 5.5
CVE-2024-42141 [MEDIUM] kernel: Bluetooth: ISO: Check socket flag instead of hcon
kernel: Bluetooth: ISO: Check socket flag instead of hcon
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Check socket flag instead of hcon
This fixes the following Smatch static checker warning:
net/bluetooth/iso.c:1364 iso_sock_recvmsg()
error: we previously assumed 'pi->conn->hcon' could be null (line 1359)
net/bluetooth/iso.c
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1348 size_t len, int flags)
1349 {
1350 struct sock *sk = sock->sk;
1351 struct iso_pinfo *pi = iso_pi(sk);
1352
1353 BT_DBG("sk %p", sk);
1354
1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP,
&bt_sk(sk)->flags)) {
1356 lock_sock(sk);
1357 switch (sk->sk_state) {
1358 case BT_CONNECT2:
1359 if (pi->conn->hcon &&
^^^^^^^^^^^^^^ If ->hcon is NULL
1360 test_bi
No detection rules found.
No public exploits indexed.
https://docs.github.com/en/[email protected]/admin/release-notes#3.10.7https://docs.github.com/en/[email protected]/admin/release-notes#3.11.5https://docs.github.com/en/[email protected]/admin/release-notes#3.8.15https://docs.github.com/en/[email protected]/admin/release-notes#3.9.10https://docs.github.com/en/[email protected]/admin/release-notes#3.10.7https://docs.github.com/en/[email protected]/admin/release-notes#3.11.5https://docs.github.com/en/[email protected]/admin/release-notes#3.8.15https://docs.github.com/en/[email protected]/admin/release-notes#3.9.10
2024-02-13
Published