Summary
A path traversal vulnerability in GitHub Enterprise Server allowed unauthenticated network attackers to influence a filesystem path used by deferred cleanup processing. Successful exploitation could recursively delete arbitrary files and directories, including storage containing Git LFS objects, release assets, attachments, and avatars.
A path traversal vulnerability in GitHub Enterprise Server allowed unauthenticated network attackers to influence a filesystem path used by deferred cleanup processing. Successful exploitation could recursively delete arbitrary files and directories, including storage containing Git LFS objects, release assets, attachments, and avatars.
Affected context
The vulnerability occurs in the GitHub Enterprise Server upload-buffer and deferred-cleanup workflow when the X-GitHub-Request-Id request header is incorporated into a filesystem path without sufficient sanitization. Deployments reachable by an attacker may be exposed because exploitation does not depend on private mode being disabled or on the attacker having an authenticated account.
The vulnerability occurs in the GitHub Enterprise Server upload-buffer and deferred-cleanup workflow when the X-GitHub-Request-Id request header is incorporated into a filesystem path without sufficient sanitization. Deployments reachable by an attacker may be exposed because exploitation does not depend on private mode being disabled or on the attacker having an authenticated account.
Exploit preconditions
- Attack surface: Network-accessible GitHub Enterprise Server request handling
- Required access: Network reachability; authentication is not required
- Trigger point: Upload-buffer path construction followed by deferred recursive cleanup
- Why exploitation is possible: A request-controlled header is used as a filesystem path segment without adequate traversal protection, allowing cleanup to target an unintended location
- Attack surface: Network-accessible GitHub Enterprise Server request handling
- Required access: Network reachability; authentication is not required
- Trigger point: Upload-buffer path construction followed by deferred recursive cleanup
- Why exploitation is possible: A request-controlled header is used as a filesystem path segment without adequate traversal protection, allowing cleanup to target an unintended location
Why this happens
The underlying bug is improper neutralization of a user-controlled path component before filesystem use. A request header was treated as a trusted directory-name segment, allowing traversal semantics to escape the intended upload-buffer directory and influence a recursive deletion operation. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
The underlying bug is improper neutralization of a user-controlled path component before filesystem use. A request header was treated as a trusted directory-name segment, allowing traversal semantics to escape the intended upload-buffer directory and influence a recursive deletion operation. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal.
Potential impact
- Arbitrary files and directories may be deleted
- Git LFS objects, release assets, attachments, and avatars could be lost
- Repository-related services may become unavailable or degraded
- Data integrity and operational continuity could be affected
- Recovery efforts may require restoration from protected backups
- Arbitrary files and directories may be deleted
- Git LFS objects, release assets, attachments, and avatars could be lost
- Repository-related services may become unavailable or degraded
- Data integrity and operational continuity could be affected
- Recovery efforts may require restoration from protected backups
General mitigation guidance
Mitigation generally focuses on preventing request-controlled values from determining filesystem locations and limiting the consequences of cleanup operations.
Common defensive patterns include:
- Resolve candidate paths against a fixed trusted base directory and verify that the result remains within that directory
- Reject traversal sequences, absolute paths, symbolic-link escapes, and other ambiguous path forms
- Use server-generated opaque identifiers rather than request headers as filesystem names
- Apply strict allowlists and canonicalization before any filesystem operation
- Restrict cleanup routines to dedicated, least-privileged storage areas
- Add authorization and safety checks before recursive deletion
- Use protected backups and recovery controls for persistent repository-associated data
Mitigation generally focuses on preventing request-controlled values from determining filesystem locations and limiting the consequences of cleanup operations.
Common defensive patterns include:
- Resolve candidate paths against a fixed trusted base directory and verify that the result remains within that directory
- Reject traversal sequences, absolute paths, symbolic-link escapes, and other ambiguous path forms
- Use server-generated opaque identifiers rather than request headers as filesystem names
- Apply strict allowlists and canonicalization before any filesystem operation
- Restrict cleanup routines to dedicated, least-privileged storage areas
- Add authorization and safety checks before recursive deletion
- Use protected backups and recovery controls for persistent repository-associated data
How teams detect issues like this
Organizations commonly detect this class of issue through:
- Static analysis rules for path construction using request headers, URL parameters, or other untrusted input
- Code review checks for filesystem APIs receiving unsanitized external values
- Tests covering canonicalization, traversal sequences, absolute paths, symbolic links, and cleanup boundaries
- Runtime monitoring for unexpected recursive deletion activity or access outside designated storage roots
- Policy enforcement requiring trusted path-joining utilities and constrained service accounts
- Automated security review tools that flag untrusted input flowing into file and directory operations
Organizations commonly detect this class of issue through:
- Static analysis rules for path construction using request headers, URL parameters, or other untrusted input
- Code review checks for filesystem APIs receiving unsanitized external values
- Tests covering canonicalization, traversal sequences, absolute paths, symbolic links, and cleanup boundaries
- Runtime monitoring for unexpected recursive deletion activity or access outside designated storage roots
- Policy enforcement requiring trusted path-joining utilities and constrained service accounts
- Automated security review tools that flag untrusted input flowing into file and directory operations
