Executive Summary

This vulnerability is an authorization bypass in GitHub Enterprise Server. It allows an attacker who already has admin access to one repository to modify the secret scanning push protection delegated bypass reviewer list on a different repository. The attacker does this by manipulating the owner_id parameter in the request body. Although authorization is checked against the repository in the URL, the action is applied to another repository specified in the request body.

The impact is limited because the attacker can only assign existing trusted users as bypass reviewers; they cannot add arbitrary external users.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could allow an attacker with admin rights on one repository to alter the secret scanning push protection settings on another repository by assigning trusted users as bypass reviewers. This could potentially weaken the security controls around secret scanning on the affected repository, allowing certain pushes to bypass secret scanning protections.

However, the attacker cannot add arbitrary external users as bypass reviewers, which limits the scope of the impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to one of the fixed versions: 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, 3.19.4, or 3.20.1.

This will ensure that the authorization bypass vulnerability related to secret scanning push protection delegated bypass reviewer list manipulation is resolved.

Useful 0 Not Useful 0