GitHub patches critical vulnerability in its Enterprise Servers | CyberScoop<\/title> <meta name=\"description\" content=\"The \u201csevere\u201d flaw could allow attackers full access to instances.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/github-enterprise-vulnerability-sso-saml\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"GitHub patches critical vulnerability in its Enterprise Servers\"> <meta property=\"og:description\" content=\"The \u201csevere\u201d flaw could allow attackers full access to instances.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/github-enterprise-vulnerability-sso-saml\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-10-16T20:24:43+00:00\"> <meta property=\"article:modified_time\" content=\"2024-10-16T20:24:44+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1323\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Christian Vasquez\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@chrismvasq\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1725982252g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1728928671g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1729103471g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ada0ad45b21fc79c6694\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/82169\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.6.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=82169\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fgithub-enterprise-vulnerability-sso-saml%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fgithub-enterprise-vulnerability-sso-saml%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-82169 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/github-enterprise-vulnerability-sso-saml\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"24.648180242634\">\n<div class=\"single-article__header-content\" readability=\"31.902654867257\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/cybersecurity\/\"> <span>Cybersecurity<\/span> <\/a> <\/li>\n<\/ul>\n<p> The \u201csevere\u201d flaw could allow attackers full access to instances. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/82169\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"441\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers.jpg?resize=640%2C441&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=300,207 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=768,529 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=1024,706 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=1536,1058 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=600,413 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=244,168 244w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=489,337 489w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=980,675 980w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-2.jpg?resize=1223,843 1223w\" sizes=\"(max-width: 980px) 100vw, 980px\"><figcaption> PARIS, FRANCE – JUNE 04: In this photo illustration the GitHub logo is seen on the screen of an iPhone in front of a computer screen showing a Microsoft logo on June 04, 2018 in Paris, France. (Photo Illustration by Chesnot\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"26.64116188452\"><body readability=\"53.726448561293\"><\/p>\n<p>GitHub\u2019s latest Enterprise Server update fixes a critical vulnerability that allows authentication bypass for on-premise deployments, according to the company.<\/p>\n<p>The bug \u2014 <a href=\"https:\/\/www.cve.org\/cverecord?id=CVE-2024-9487\">CVE-2024-9487<\/a> \u2014 impacts GitHub\u2019s enterprise product and does not affect its software-as-a-service products, according to the company\u2019s <a href=\"https:\/\/docs.github.com\/en\/enterprise-server@3.14\/admin\/release-notes\">release.<\/a> The Microsoft-owned company said the bug, which is a 9.5 on the CVSS scale, would allow hackers to bypass a method typically used by companies to verify employee identities using single sign-on called Security Assertion Markup Language (SAML).<\/p>\n<p>Chris Hatter, chief technology officer of the application security company Qwiet.Ai, called the vulnerability \u201csevere\u201d and said that organizations should ensure they understand their relevant network architectures. <\/p>\n<p>Hatter said companies should block any \u201croutes to this access\u201d and ensure that they have \u201ctelemetry to be able to understand who is accessing these resources by whom and from where.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Hatter said a typical attack would likely require a malicious actor to already have access to internal networks in order to use the vulnerability. He cautioned that some organizations might publish Enterprise Servers to the open internet, but it would be unusual. <\/p>\n<p>The bug forges the authentication request that identity providers use to verify a person is signing onto an approved service. Most people have multiple identities for work \u2014 a recent report from Push Security noted that companies have on average <a href=\"https:\/\/pushsecurity.com\/blog\/how-many-vulnerable-identities-do-you-have\/\">15 identities per employee<\/a> \u2014 and SAML SSOs help organizations manage authorization and access.<\/p>\n<p>Hatter said GitHub Enterprise Servers could be a \u201ctreasure trove of information\u201d for hackers. Accessed instances could include \u201csource code, architectural documents, information about developers,\u201d which could be useful for espionage, social engineering attacks, and IP theft, among other acts.<\/p>\n<p>\u201cIf you have access to the source code and you have administrative privileges into the source code management systems, theoretically you could start to manipulate that source code and implement a back door,\u201d Hatter said.<\/p>\n<p>GitHub\u2019s latest update fixes a regression of <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-4985\">CVE-2024-4985<\/a>, a vulnerability with a 10.0 CVSS score that was <a href=\"https:\/\/www.theregister.com\/2024\/08\/21\/patch_github_enterprise_bug\/\">first patched by GitHub in May<\/a>.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The Oct. 6 update had two other security fixes: a bug in SVG assets that allows for possible metadata retrieval \u2014 <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-9539\">CVE-2024-9539<\/a> \u2014 and a functionality from the management console that could allow sensitive data exposure in HTML forms was removed.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.7614035087719\">\n<div class=\"author-card\" readability=\"9\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/github-patches-critical-vulnerability-in-its-enterprise-servers-1.jpg?w=640&ssl=1\" alt=\"Christian Vasquez\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Christian Vasquez<\/h4>\n<p> Christian covers industrial cybersecurity for CyberScoop News. He previously wrote for E&E News at POLITICO covering cybersecurity in the energy sector. Reach out: christian.vasquez at cyberscoop dot com <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/github-enterprise-vulnerability-sso-saml\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>GitHub patches critical vulnerability in its Enterprise Servers | CyberScoop<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[78,725,256,643,2281],"tags":[86,728,262,645,2283],"class_list":["post-5814","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-github","category-research","category-vulnerabilities","category-vulnerability","tag-cybersecurity","tag-github","tag-research","tag-vulnerabilities","tag-vulnerability"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/github\/\" rel=\"category tag\">GitHub<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vulnerabilities\/\" rel=\"category tag\">vulnerabilities<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vulnerability\/\" rel=\"category tag\">vulnerability<\/a>","tag_info":"vulnerability","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5814"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5814\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":5814,"date":"2024-10-16T15:24:43","date_gmt":"2024-10-16T20:24:43","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=82169"},"modified":"2024-10-16T15:24:43","modified_gmt":"2024-10-16T20:24:43","slug":"github-patches-critical-vulnerability-in-its-enterprise-servers","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/10\/16\/github-patches-critical-vulnerability-in-its-enterprise-servers\/","title":{"rendered":"GitHub patches critical vulnerability in its Enterprise Servers"},"content":{"rendered":"