GitHub Enterprise Server DOM-Based Cross-Site Scripting Vulnerability

A DOM-based cross-site scripting vulnerability has been identified in GitHub Enterprise Server. This issue arises from improper handling of task list content, which allowed user-supplied HTML to be injected and executed as scripts in the context of another user's browser session. The vulnerability affects all versions of GitHub Enterprise Server prior to 3.20. An authenticated attacker could exploit this by crafting malicious task list items in issues or pull requests.

Impact

Exploitation of this vulnerability allows for arbitrary script execution in the context of the affected user's browser session, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, an authenticated user can create a task list item in an issue or pull request that includes malicious HTML. When the task list is rendered, the injected HTML is executed as a script in the browser, bypassing Content Security Policy protections.

Remediation

Users can upgrade to GitHub Enterprise Server versions 3.18.6 or 3.19.3, both of which include the necessary fix.