CVE-2017-18365

Vulnerability

The Management Console in GitHub Enterprise versions 2.8.0 through 2.8.6 contains a deserialization vulnerability. The enterprise session secret is hardcoded and can be found in the product's source code. An attacker can craft a cookie signed with this secret and use it to call Marshal.load with arbitrary data, allowing execution of arbitrary Ruby objects. [1]

Exploitation

An unauthenticated remote attacker can exploit this by sending a specially crafted cookie to the Management Console, which is accessible on ports 8080 and 8443. No prior authentication or access is required. The hardcoded secret is known, so the attacker can forge a valid cookie that triggers deserialization of a malicious payload. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary code on the GitHub Enterprise appliance. This leads to full compromise of the appliance, including potential data access, modification, and further lateral movement. The attacker gains the highest level of privileges on the system. [1]

Mitigation

The vulnerability is fixed in GitHub Enterprise version 2.8.7, released January 31, 2017. Users should upgrade to 2.8.7 or later. No workarounds are mentioned in the reference. [1]