Path Traversal in GitHub Enterprise Server

Executive Summary

This is a path traversal vulnerability in GitHub Enterprise Server. An attacker with code execution inside the Dependabot updater container could write files to arbitrary repository paths, including GitHub Actions workflow files. The path validation did not check the effective path, which the attacker could manipulate through the dependency file's directory and symlink target. This allowed injecting malicious workflows that could execute with access to repository secrets.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires checking for unauthorized GitHub Actions workflow files in .github/workflows/ directories. Inspect repository contents for unexpected workflow files, especially those referencing secrets or external actions. Review Dependabot updater container logs for suspicious file writes or symlink manipulations. Check for pull_request_target workflows or auto-merge settings that could execute injected workflows.

Useful 0 Not Useful 0

Impact Analysis

If you use GitHub Enterprise Server versions prior to 3.22, an attacker could inject malicious GitHub Actions workflows into your repositories. If your repository uses pull_request_target workflows or has auto-merge enabled, these injected workflows could execute with access to your repository's secrets, potentially leading to unauthorized access, data theft, or further compromise of your systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to repository files, including GitHub Actions workflows that may handle sensitive data. If exploited, it could lead to unauthorized code execution with access to secrets, violating confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update GitHub Enterprise Server to a fixed version (3.21.3, 3.20.5, 3.19.9, 3.18.12, or 3.17.18 or later) to address the path traversal vulnerability in the Dependabot updater container.

Useful 0 Not Useful 0