GitHub Enterprise Server Shell Metacharacter Injection Vulnerability Allowing Arbitrary Command Execution

A vulnerability in GitHub Enterprise Server prior to 3.21 allows authenticated Management Console administrators to execute arbitrary operating system commands. This is achieved through shell metacharacter injection in proxy configuration fields, such as http_proxy. Exploitation requires access to the GitHub Enterprise Server instance and administrator privileges in the Management Console.

Impact

Successful exploitation allows for arbitrary command execution on the server as the admin OS user.

Remediation

Users can upgrade to GitHub Enterprise Server versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, or 3.14.26.