A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as during a hot patch upgrade. Exploitation requires specific permissions, limiting the attack window.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2025-3509 |
Exploitation
To exploit this vulnerability, an attacker must have site administrator permissions to enable and configure pre-receive hooks or be a user with permissions to modify repositories containing pre-receive hooks. The attacker can then execute arbitrary code during specific operational conditions when dynamically allocated ports are available.
Affected Products
- GitHub Enterprise Server versions prior to 3.18
Mitigation
To mitigate this vulnerability, users should upgrade to GitHub Enterprise Server versions 3.17.1, 3.16.4, 3.15.8, 3.14.13, or 3.13.16, where the issue has been addressed.