GitHub Enterprise Server 3.20.1 Security Advisory: Auth Bypass, RCE, and Side-Channel Fixes

GitHub Enterprise Server 3.20.1 Security Vulnerability Summary Vulnerability Overview GitHub Enterprise Server version 3.20.1 fixes multiple security vulnerabilities, including: 1. Authorization Bypass Vulnerability: Attackers can abuse ghu_ tokens scoped from user-to-server to gain unauthorized access after the associated GitHub App installation is revoked or deleted. 2. Side-Channel Attack Vulnerability: Attackers can extract sensitive environment variables from a GitHub Enterprise Server instance via timing side-channel attacks. 3. Command Injection Vulnerability: Administrators of the Management Console can inject shell metacharacters through configuration fields, leading to arbitrary command execution on the administrative OS user. 4. Regular Expression Vulnerability: Attackers can exploit incorrect regular expression matching in OAuth callback URL validation to gain unauthorized access to registered users of the target application. 5. Merge Request Vulnerability: An attacker without write access can merge their own pull request into a fork-allowed repository by exploiting improper authorization checks in . 6. Secret Scanning Vulnerability: An attacker with permission to manage secret scanning push protection settings can add or remove delegated reviewers by exploiting improper authorization checks in the endpoint. 7. Information Disclosure Vulnerability: An authenticated attacker can determine the names of private repositories via the mobile upload policy API endpoint. 8. Ruleset Access Vulnerability: Security Managers have unexpected access permissions, allowing them to create or modify organization rulesets. Impact Scope All users of GitHub Enterprise Server version 3.20.1 Involves multiple functional modules including private repositories, organization management, security scanning, and API access Attackers may gain unauthorized access, extract sensitive information, execute arbitrary commands, etc. Remediation Upgrade to GitHub Enterprise Server version 3.20.1 This version has fixed all listed security vulnerabilities It is recommended to report similar vulnerabilities through the GitHub Bug Bounty program POC Code The page does not contain specific POC code or exploitation code.

Goal Reached Thanks to every supporter — we hit 100%!

GitHub Enterprise Server 3.20.1 Security Advisory: Auth Bypass, RCE, and Side-Channel Fixes