Stored XSS in GitHub Enterprise Server Discussion Titles

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary JavaScript code in the browsers of other users who view the affected Discussion titles. This can lead to session hijacking, theft of sensitive information, unauthorized actions performed on behalf of the victim user, or distribution of malware.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to one of the fixed versions: 3.20.4, 3.19.8, 3.18.11, or 3.17.17.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in GitHub Enterprise Server. An authenticated attacker can inject malicious JavaScript code into the title of a Discussion in the Q&A category. The problem arises because the component that handles the Discussion titles does not properly escape user input before embedding it inside a script block. This allows the injected code to break out of the intended script context.

The attacker can escalate this injection to a full cross-site scripting attack by exploiting JSONP callback support in the REST API, which bypasses the Content Security Policy protections. This means the malicious script can execute in other users' browsers, potentially compromising their sessions or data.

Useful 0 Not Useful 0