CVE-2024-10001: Code Injection
First published: Wed Jan 29 2025(Updated: )
A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens. To execute the attack, the victim must be logged into GitHub and interact with the attacker controlled malicious webpage containing the hidden iframe. This vulnerability occurs due to an improper sequence of validation, where the origin check occurs after accepting the user-controlled identity property. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.11.16, 3.12.10, 3.13.5, 3.14.2, and 3.15.0. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise Server | <3.11.16 | |
| GitHub Enterprise Server | <3.12.10 | |
| GitHub Enterprise Server | <3.13.5 | |
| GitHub Enterprise Server | <3.14.2 | |
| GitHub Enterprise Server | <3.15.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.17
- https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.11
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.6
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.3
- https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.0
Frequently Asked Questions
What is the severity of CVE-2024-10001?
CVE-2024-10001 is classified as a critical vulnerability due to its potential to allow code injection and data exfiltration.
How do I fix CVE-2024-10001?
To fix CVE-2024-10001, update your GitHub Enterprise Server to version 3.11.17 or later, 3.12.11 or later, 3.13.6 or later, 3.14.3 or later, or 3.15.1 or later.
Which versions of GitHub Enterprise Server are affected by CVE-2024-10001?
CVE-2024-10001 affects GitHub Enterprise Server versions prior to 3.11.17, 3.12.11, 3.13.6, 3.14.3, and 3.15.1.
What is the nature of vulnerability CVE-2024-10001?
CVE-2024-10001 is a code injection vulnerability that allows attackers to inject malicious code via the identity property in the message handling function.
What types of data can be exfiltrated due to CVE-2024-10001?
Due to CVE-2024-10001, attackers could potentially exfiltrate sensitive data by manipulating the DOM.
- collector/nvd-api
- source/NVD
- agent/event
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/source
- agent/first-publish-date
- agent/description
- agent/type
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/github
- canonical/github enterprise server