GitHub Enterprise Server Server-Side Request Forgery Vulnerability in Notebook Viewer

A server-side request forgery (SSRF) vulnerability exists in the GitHub Enterprise Server notebook viewer, affecting all versions prior to 3.21. This vulnerability allows attackers to access internal services by exploiting a mismatch in URL parsing between the validation layer and the HTTP request library. Exploitation requires network access to the GitHub Enterprise Server instance with private mode disabled.

Impact

Exploitation of this vulnerability could lead to unauthorized access of internal services, potentially allowing attackers to manipulate or disrupt those services.

Remediation

This vulnerability has been fixed in GitHub Enterprise Server versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2.