CVE-2024-52308: GitHub CLI Vulnerability Could Allow Remote Code Execution
A critical security vulnerability (CVE-2024-52308) in the GitHub Command Line Interface (CLI) has been identified, potentially enabling remote code execution (RCE) on users’ workstations. This vulnerability, with a CVSS score of 8.1, underscores the importance of diligent software update practices and security awareness among developers.
The vulnerability stems from how the gh CLI processes Secure Shell (SSH) connection details when interacting with GitHub Codespaces. Codespaces, a cloud-based development environment, relies on SSH for secure communication between the user’s local machine and the remote Codespace.
According to GitHub’s security advisory, “This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects ssh arguments within the SSH connection details. gh codespace ssh and gh codespace logs commands could execute arbitrary code on the user’s workstation if the remote username contains something like -oProxyCommand=”echo hacked” #.“
This means that if a user connects to a malicious Codespace, the compromised SSH server can manipulate the connection details to inject arbitrary commands. These commands would then be executed on the user’s machine, potentially leading to data breaches, system compromise, or further malicious activities.
A successful exploit enables remote code execution (RCE) on the victim’s workstation. This could compromise the user’s system, exposing sensitive data or enabling further attacks. According to GitHub, “Successful exploitation could lead to arbitrary code execution on the user’s workstation, potentially compromising the user’s data and system.”
GitHub has promptly addressed this vulnerability with the release of gh CLI version 2.62.0. Immediate mitigation necessitates upgrading to this latest version.
Furthermore, GitHub advises developers to exercise caution when utilizing custom devcontainer images. “Prefer default or pre-built devcontainers from trusted sources,” the advisory recommends, emphasizing the importance of secure development practices.
