Description

CVE-2024-4985 is an authentication bypass vulnerability in GitHub Enterprise Server (GHES) that allows attackers to forge SAML responses and gain site administrator privileges without prior authentication. This vulnerability affects all GHES versions before 3.13.0 and is actively exploited in the wild.

Key Insights

• High Severity: The SVRS of 56 indicates a moderate severity, highlighting the need for prompt attention.
• Exploitation in the Wild: This vulnerability is actively exploited by hackers, making it crucial for organizations to take immediate action.
• Unauthorized Access: Exploitation of this vulnerability can lead to unauthorized access to GHES instances, potentially compromising sensitive data and disrupting operations.
• Threat Actors: Specific threat actors or APT groups exploiting this vulnerability are not mentioned in the provided information.

Mitigation Strategies

• Update GHES: Upgrade to GHES version 3.13.0 or later to patch the vulnerability.
• Disable Encrypted Assertions: If possible, disable the optional encrypted assertions feature in SAML single sign-on authentication.
• Implement Multi-Factor Authentication: Enable multi-factor authentication to add an extra layer of security and prevent unauthorized access.
• Monitor for Suspicious Activity: Regularly monitor GHES logs and systems for any suspicious activity or unauthorized access attempts.

Additional Information

• The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• Users with additional queries can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.