Proxy configuration command injection vulnerability found in GitHub Enterprise Server Management Console configuration API

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as http_proxy. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and administrator privileges to the Management Console. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server是美国GitHub开源的一个应用软件。提供一个将自己的GitHub实例设置为虚拟设备，从而提供可扩展，易于管理的平台。 GitHub Enterprise Server 3.21之前版本存在安全漏洞，该漏洞源于代理配置字段如http_proxy中特殊元素中和不当，可能导致经过身份验证的管理控制台管理员执行任意OS命令。

N/A

N/A