CVE-2021-22869: Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group
First published: Fri Sep 24 2021(Updated: )
An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group could access all of the enterprise runner groups within the organization because of improper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runner group. This vulnerability affected GitHub Enterprise Server versions from 3.0.0 to 3.0.15 and 3.1.0 to 3.1.7 and was fixed in 3.0.16 and 3.1.8 releases.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | >=3.0.0<3.0.16 | |
| GitHub Enterprise Server | >=3.1.0<3.1.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.0/admin/release-notes#3.0.16
- https://docs.github.com/en/enterprise-server@3.1/admin/release-notes#3.1.8
- https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.16
- https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.8
Frequently Asked Questions
What is CVE-2021-22869?
CVE-2021-22869 is an improper access control vulnerability in GitHub Enterprise Server that allowed a workflow job to execute in a self-hosted runner group it should not have had access to.
Who is affected by CVE-2021-22869?
Customers using self-hosted runner groups for access control in GitHub Enterprise Server versions 3.0.0 to 3.0.16 and 3.1.0 to 3.1.8 are affected by CVE-2021-22869.
What is the severity of CVE-2021-22869?
CVE-2021-22869 has a severity rating of 9.8 (Critical).
How can I fix CVE-2021-22869?
To fix CVE-2021-22869, it is recommended to update GitHub Enterprise Server to version 3.0.17 or 3.1.9, which contains the necessary security patches.
Where can I find more information about CVE-2021-22869?
You can find more information about CVE-2021-22869 in the release notes of GitHub Enterprise Server versions 3.0.16 and 3.1.8.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/title
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/github
- canonical/github enterprise server
- version/github enterprise server/3.0.0
- version/github enterprise server/3.1.0