GitHub Enterprise SAML Bypass and RCE Vulnerability Advisory

Critical Vulnerability Information SAML Authentication Bypass via XML Signature Wrapping Severity: CRITICAL Description: Attackers can bypass SAML authentication if they have access to legitimate signed SAML assertions or responses. Affected Versions: - 2.8.0 - 2.8.6 - 2.7.0 - 2.7.10 - 2.6.0 - 2.6.15 - 2.5.0 - 2.5.20 - 2.4.0 - 2.4.22 Server-Side Request Forgery Leading to Remote Code Execution Severity: CRITICAL Description: Attackers can execute arbitrary commands on GitHub Enterprise devices if they have access to Webhooks in configured repositories. Affected Versions: - 2.8.0 - 2.8.6 - 2.7.0 - 2.7.10 - 2.6.0 - 2.6.15 - 2.5.0 - 2.5.20 - 2.4.0 - 2.4.22 Remote Code Execution in GitHub Enterprise Management Console Severity: CRITICAL Description: Attackers can execute arbitrary commands on GitHub Enterprise devices. This vulnerability exists in the Management Console, accessible via ports 8080 and 8443. Applies only to versions 2.8.0 - 2.8.6. Next Steps Strongly recommended to upgrade to the latest patched versions: 2.8.7, 2.7.11, 2.6.16, 2.5.21, or 2.4.23. If SAML authentication is configured, all existing SAML user sessions must be invalidated. Recommended to restrict Management Console access to site administrators only. Security Fixes CRITICAL: Attackers can bypass SAML authentication via XML signature wrapping and log in as any user. CRITICAL: Server-side request forgery leading to remote code execution. CRITICAL: Remote code execution vulnerability in Management Console. HIGH: Suspended users can log in when using built-in authentication.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub Enterprise SAML Bypass and RCE Vulnerability Advisory