Updates have been issued by GitHub to remediate a maximum severity security vulnerability impacting its self-hosted software development platform GitHub Enterprise Server, tracked as CVE-2024-4985, which could be exploited to evade authentication defenses, The Hacker News reports.
Attackers could leverage the flaw, which affects all GHES versions older than 3.13.0, to obtain unauthorized access to GHES instances with SAML single sign-on authentication and the optional encrypted assertions feature, according to GitHub.
"On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an attacker could forge a SAML response to provision and/or gain access to a user with administrator privileges," said GitHub.
Immediate updates to GHES versions 3.9.15, 3.10.12, 3.11.10, and 3.12.4 are crucial for organizations with vulnerable GHES instances, noted GitHub, which emphasized that the security issue has not impacted GHES instances without SAML SSO or with SAML SSO but not encrypted assertions that enable the encryption of SAML identity provider messages.
