CVE-2025-3509: Pre-Receive Hook Remote Code Execution vulnerability was identified in GitHub Enterprise Server that allowing Privilege Escalation
First published: Thu Apr 17 2025(Updated: )
A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as during a hot patch upgrade. This means the vulnerability is only exploitable during specific operational conditions, which limits the attack window. Exploitation required either site administrator permissions to enable and configure pre-receive hooks or a user with permissions to modify repositories containing pre-receive hooks where this functionality was already enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.17 and was fixed in versions 3.16.2, 3.15.6, 3.14.11, 3.13.14. This vulnerability was reported via the GitHub Bug Bounty program.
Credit: product-cna@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitHub Enterprise | <3.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.14
- https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.11
- https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.6
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2
Frequently Asked Questions
What is the severity of CVE-2025-3509?
CVE-2025-3509 is classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-3509?
To mitigate CVE-2025-3509, upgrade your GitHub Enterprise Server to version 3.17 or later.
What is the impact of CVE-2025-3509 on GitHub Enterprise Server?
CVE-2025-3509 allows attackers to execute arbitrary code, potentially leading to privilege escalation and system compromise.
Which versions of GitHub Enterprise Server are affected by CVE-2025-3509?
CVE-2025-3509 affects all versions of GitHub Enterprise Server up to, but not including, version 3.17.
Can CVE-2025-3509 be exploited without authentication?
Yes, CVE-2025-3509 can be exploited by unauthenticated attackers utilizing the pre-receive hook functionality.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/github
- canonical/github enterprise