CVE-2024-2443: 
GitHub Enterprise Server vulnerability analysis and mitigation

A command injection vulnerability (CVE-2024-2443) was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring GeoJSON settings. The vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. This vulnerability was reported via the GitHub Bug Bounty program (NVD).

The vulnerability is classified as a command injection vulnerability (CWE-20: Improper Input Validation) that could be exploited by an attacker with editor role access to the Management Console. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) (NVD).

Successful exploitation of this vulnerability would allow an attacker to gain administrative SSH access to the GitHub Enterprise Server appliance, effectively providing complete control over the system. The attack requires access to both the GitHub Enterprise Server instance and the Management Console with editor role privileges (NVD).

The vulnerability requires the attacker to have access to the GitHub Enterprise Server instance and editor role access to the Management Console. The exploitation occurs specifically when configuring GeoJSON settings in the Management Console (NVD).

GitHub has released patches to address this vulnerability in multiple versions: 3.8.17, 3.9.12, 3.10.9, 3.11.7, and 3.12.1. Users are advised to upgrade their GitHub Enterprise Server installations to these patched versions or later to mitigate the vulnerability (GitHub Release Notes).