Authorization Bypass in GitHub Enterprise Server

Executive Summary

This vulnerability is a missing authorization flaw in GitHub Enterprise Server. It allowed an authenticated user to read source code from private repositories they were not authorized to access.

Specifically, the Copilot pull request description diff summary endpoint accepted a cross-repository comparison range and rendered the resulting diff without verifying if the user had permission to view the target repository.

To exploit this, an attacker needed an authenticated account with read access to at least one repository on the instance to use as a comparison base.

This issue affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, and 3.20.4.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of private source code by allowing an authenticated user to access code from repositories they should not have permission to view.

Such unauthorized access can result in intellectual property theft, exposure of sensitive or proprietary information, and potential compromise of the security posture of affected projects.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitHub Enterprise Server to one of the fixed versions: 3.17.17, 3.18.11, 3.19.8, or 3.20.4 or later.

Ensure that only authenticated users with appropriate repository access are allowed to use the Copilot pull request description diff summary endpoint.

Useful 0 Not Useful 0