Summary
A server-side request forgery vulnerability in GitHub Enterprise Server's secret scanning validator allowed a repository contributor to make the appliance request attacker-controlled internal endpoints. Under a non-default configuration, this behavior could be chained to reach remote code execution on the appliance.
A server-side request forgery vulnerability in GitHub Enterprise Server's secret scanning validator allowed a repository contributor to make the appliance request attacker-controlled internal endpoints. Under a non-default configuration, this behavior could be chained to reach remote code execution on the appliance.
Affected context
The issue occurs when GitHub Advanced Security and secret scanning validity checks are enabled on a GitHub Enterprise Server instance. A committed GCP service account credential containing an attacker-selected token endpoint could be processed by the validator, which trusted that endpoint without adequately restricting its destination.
The issue occurs when GitHub Advanced Security and secret scanning validity checks are enabled on a GitHub Enterprise Server instance. A committed GCP service account credential containing an attacker-selected token endpoint could be processed by the validator, which trusted that endpoint without adequately restricting its destination.
Exploit preconditions
- Attack surface: Secret scanning validity checks performed by the appliance - Required access: An authenticated repository contributor with permission to
push commits
- Deployment condition: GitHub Advanced Security and secret scanning validity
checks must be enabled
- Trigger point: Validation of a committed GCP service account credential - Why exploitation is possible: The validator uses a token endpoint supplied
within the credential and does not sufficiently constrain outbound
destinations, allowing requests to attacker-controlled or internal hosts
- Attack surface: Secret scanning validity checks performed by the appliance - Required access: An authenticated repository contributor with permission to
push commits
- Deployment condition: GitHub Advanced Security and secret scanning validity
checks must be enabled
- Trigger point: Validation of a committed GCP service account credential - Why exploitation is possible: The validator uses a token endpoint supplied
within the credential and does not sufficiently constrain outbound
destinations, allowing requests to attacker-controlled or internal hosts
Why this happens
The underlying bug is server-side request forgery, mapped to CWE-918. The validator treated a network destination supplied through repository content as trusted and used it for an outbound request without enforcing an allowlist, destination policy, or equivalent network boundary. This insecure trust relationship can expose internal services and, where reachable functionality is vulnerable, support further compromise.
The underlying bug is server-side request forgery, mapped to CWE-918. The validator treated a network destination supplied through repository content as trusted and used it for an outbound request without enforcing an allowlist, destination policy, or equivalent network boundary. This insecure trust relationship can expose internal services and, where reachable functionality is vulnerable, support further compromise.
Potential impact
- The appliance may send requests to attacker-controlled endpoints.
- An attacker could access or probe internal network services.
- Sensitive response data may be exposed through the request workflow.
- Internal administrative interfaces could be abused.
- The vulnerability could be chained to achieve remote code execution on the appliance.
- The appliance may send requests to attacker-controlled endpoints.
- An attacker could access or probe internal network services.
- Sensitive response data may be exposed through the request workflow.
- Internal administrative interfaces could be abused.
- The vulnerability could be chained to achieve remote code execution on the appliance.
General mitigation guidance
Mitigation generally focuses on treating all endpoint values derived from repository content as untrusted. Secure-by-default patterns include using fixed service endpoints or tightly scoped destination allowlists, rejecting private, loopback, link-local, and otherwise restricted address ranges, validating resolved destinations, and preventing redirects from bypassing those controls. Outbound network access should be minimized through egress policies, and the appliance service should operate with only the privileges required for validation. Configuration should avoid enabling network-backed validation unless its trust boundary and destination policy are explicitly defined.
Mitigation generally focuses on treating all endpoint values derived from repository content as untrusted. Secure-by-default patterns include using fixed service endpoints or tightly scoped destination allowlists, rejecting private, loopback, link-local, and otherwise restricted address ranges, validating resolved destinations, and preventing redirects from bypassing those controls. Outbound network access should be minimized through egress policies, and the appliance service should operate with only the privileges required for validation. Configuration should avoid enabling network-backed validation unless its trust boundary and destination policy are explicitly defined.
How teams detect issues like this
Detection can include static analysis and code review for HTTP clients that consume URLs from repository files, credentials, or other user-controlled input without destination validation. Reviewers should look for missing protections against private address spaces, DNS rebinding, redirects, and alternate IP representations. Runtime monitoring can alert on unexpected outbound connections from the appliance, while network policy can enforce approved egress destinations. Automated security review tools may help flag SSRF-prone request construction.
Detection can include static analysis and code review for HTTP clients that consume URLs from repository files, credentials, or other user-controlled input without destination validation. Reviewers should look for missing protections against private address spaces, DNS rebinding, redirects, and alternate IP representations. Runtime monitoring can alert on unexpected outbound connections from the appliance, while network policy can enforce approved egress destinations. Automated security review tools may help flag SSRF-prone request construction.
Sources
| Source | Link |
|---|---|
| docs. | docs.github.com/ |
| docs. | docs.github.com/ |
| docs. | docs.github.com/ |
