Executive Summary

This vulnerability is a reflected HTML injection found in the GitHub Enterprise Server Management Console login page. Specifically, the redirect_to query parameter on the /setup/unlock endpoint is reflected into an HTML attribute without proper sanitization. This flaw allows an attacker to inject a form element that can capture administrator credentials.

To exploit this vulnerability, an attacker would need to craft a malicious link and trick an administrator into clicking it and entering their credentials, which could then be stolen.

The vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to credential theft of administrator accounts if exploited. An attacker who successfully tricks an administrator into clicking a crafted link and entering their credentials could capture those credentials.

Compromise of administrator credentials can lead to unauthorized access to the GitHub Enterprise Server, potentially allowing the attacker to manipulate repositories, access sensitive data, or disrupt services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to version 3.19.6 or later if you are running any version from 3.19.1 through 3.19.5, or to version 3.20.2 or later if you are running versions 3.20.0 through 3.20.1.

Additionally, advise administrators to avoid clicking on suspicious or untrusted links that could exploit the reflected HTML injection vulnerability on the /setup/unlock endpoint.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to inject malicious HTML to capture administrator credentials by exploiting a reflected HTML injection flaw in the GitHub Enterprise Server Management Console login page.

Credential theft incidents can lead to unauthorized access to sensitive data, which may result in non-compliance with data protection regulations such as GDPR and HIPAA that require safeguarding user credentials and preventing unauthorized access.

Therefore, exploitation of this vulnerability could potentially compromise compliance with standards that mandate strict access controls and protection of personal and sensitive information.

Useful 0 Not Useful 0