UI Misrepresentation in GitHub Enterprise Server

Executive Summary

This vulnerability is a UI misrepresentation issue in GitHub Enterprise Server that allowed an OAuth application to gain unintended access to an organization's runner management.

An attacker could exploit this by creating an OAuth application that requests the manage_runners:org scope and then directing a victim user to authorize it. The problem was that this scope was not displayed on the authorization consent screen, so the user was unaware of the permissions being granted.

This affected all versions of GitHub Enterprise Server prior to version 3.22 and was fixed in several patch versions including 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, and 3.16.20.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to gain unauthorized access to your organization's runner management in GitHub Enterprise Server.

Since the attacker can manage runners, they could potentially manipulate or control the runners used for your organization's workflows, which could lead to unauthorized code execution or disruption of your CI/CD pipelines.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to one of the fixed versions: 3.21.2, 3.20.4, 3.19.8, 3.18.11, 3.17.17, or 3.16.20.

This vulnerability affects all versions prior to 3.22, so applying the update will prevent OAuth applications from gaining unintended access to organization runner management.

Useful 0 Not Useful 0