critical
9.6
CWE
77
Advisory Published
CVE Published
Updated

CVE-2024-52308: Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

First published: Thu Nov 14 2024(Updated: )

### Summary A security vulnerability has been identified in GitHub CLI that could allow remote code execution (RCE) when users connect to a malicious Codespace SSH server and use the `gh codespace ssh` or `gh codespace logs` commands. ### Details The vulnerability stems from the way GitHub CLI handles SSH connection details when executing commands. When developers connect to remote Codespaces, they typically use a SSH server running within a devcontainer, often provided through the [default devcontainer image](https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration). GitHub CLI [retrieves SSH connection details](https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244), such as remote username, which is used in [executing `ssh` commands](https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263) for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used. ### Impact Successful exploitation could lead to arbitrary code execution on the user's workstation, potentially compromising the user's data and system. ### Remediation and Mitigation 1. Upgrade `gh` to `2.62.0` 2. Exercise caution when using custom devcontainer images, prefer default or pre-built devcontainers from trusted sources.

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
go/github.com/cli/cli<2.62.0
2.62.0
go/github.com/cli/cli/v2<=2.61.0
2.62.0
GitHub CLI<2.62.0
debian/gh<=2.23.0+dfsg1-1<=2.46.0-1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-52308?

    CVE-2024-52308 has been categorized as a critical vulnerability due to its potential for remote code execution.

  • How do I fix CVE-2024-52308?

    To fix CVE-2024-52308, update GitHub CLI to version 2.62.0 or later.

  • What commands are affected by CVE-2024-52308?

    The vulnerable commands include 'gh codespace ssh' and 'gh codespace logs'.

  • Which versions of GitHub CLI are vulnerable to CVE-2024-52308?

    All versions of GitHub CLI prior to 2.62.0 are vulnerable to CVE-2024-52308.

  • Can CVE-2024-52308 be exploited without user interaction?

    Yes, CVE-2024-52308 can be exploited when users unknowingly connect to a malicious Codespace SSH server.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203