CVE-2024-0200 PoC — GitHub Enterprise Server 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0200.yaml

Associated Vulnerability

Title:GitHub Enterprise Server 安全漏洞 (CVE-2024-0200)
Description:GitHub Enterprise Server是美国GitHub开源的一个应用软件。提供一个将自己的GitHub实例设置为虚拟设备，从而提供可扩展，易于管理的平台。 GitHub Enterprise Server存在安全漏洞，该漏洞源于存在注入漏洞，可能导致执行用户控制的方法和远程代码执行。

Description

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the GHES instance with the organization owner role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.8.13, 3.9.8, 3.10.5, and 3.11.3.

File Snapshot


 id: CVE-2024-0200

info:
  name: Github Enterprise Authenticated Remote Code Execution
  author: iam

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!