GitHub Enterprise Server Server-Side Request Forgery Vulnerability in Upload Endpoint

A server-side request forgery (SSRF) vulnerability exists in GitHub Enterprise Server versions prior to 3.22. This vulnerability allows an unauthenticated attacker to send crafted requests to internal services by exploiting inadequate input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could manipulate the request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal services and exposure of sensitive credentials.

Remediation

Users can upgrade to GitHub Enterprise Server versions 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, or 3.21.1. Instructions for upgrading can be found in the GitHub Enterprise Server documentation.