CVE-2021-22861
Improper access control in GitHub Enterprise Server leading to unauthorized write access to forkable repositories
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability affected all versions of GitHub Enterprise Server since 2.4.21 and was fixed in versions 2.20.24, 2.21.15, 2.22.7 and 3.0.1. This vulnerability was reported via the GitHub Bug Bounty program.
Se identificó una vulnerabilidad de control de acceso inadecuada en GitHub Enterprise Server que permitía a los usuarios autenticados de la instancia obtener acceso de escritura a repositorios no autorizados a través de solicitudes de extracción y solicitudes de API REST específicamente diseñadas. Un atacante tendría que ser capaz de bifurcar el repositorio objetivo, una configuración que está desactivada por defecto para los repositorios privados propiedad de la organización. Las protecciones de la rama, como las revisiones requeridas de las solicitudes de extracción o las comprobaciones de estado, evitarían que las confirmaciones no autorizadas se fusionaran sin una revisión o validación adicional. Esta vulnerabilidad afectaba a todas las versiones de GitHub Enterprise Server desde la versión 2.4.21 y fue corregida en las versiones 2.20.24, 2.21.15, 2.22.7 y 3.0.1. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-06 CVE Reserved
- 2021-03-03 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-285: Improper Authorization
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://docs.github.com/en/enterprise-server%402.20/admin/release-notes#2.20.24 | X_refsource_misc | |
| https://docs.github.com/en/enterprise-server%402.21/admin/release-notes#2.21.15 | X_refsource_misc | |
| https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.7 | X_refsource_misc | |
| https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.1 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Github Search vendor "Github" | Github Search vendor "Github" for product "Github" | >= 2.4.21 < 2.20.24 Search vendor "Github" for product "Github" and version " >= 2.4.21 < 2.20.24" | enterprise |
Affected
| ||||||
| Github Search vendor "Github" | Github Search vendor "Github" for product "Github" | >= 2.21.0 < 2.21.15 Search vendor "Github" for product "Github" and version " >= 2.21.0 < 2.21.15" | enterprise |
Affected
| ||||||
| Github Search vendor "Github" | Github Search vendor "Github" for product "Github" | >= 2.22.0 < 2.22.7 Search vendor "Github" for product "Github" and version " >= 2.22.0 < 2.22.7" | enterprise |
Affected
| ||||||
| Github Search vendor "Github" | Github Search vendor "Github" for product "Github" | >= 3.0.0 < 3.0.1 Search vendor "Github" for product "Github" and version " >= 3.0.0 < 3.0.1" | - |
Affected
| ||||||