Remote Code Execution Vulnerability in GitHub CLI (gh) Prior to v2.62.0
Summary
CVE-2024-52308: The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using gh codespace ssh or gh codespace logs commands. Affects gh versions < cd3f2ad064fbeca17d330e321fef0591eaa0fea5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitHub CLI (gh) is a command-line tool that allows developers to interact with GitHub from the terminal. It provides functionalities such as creating issues, managing pull requests, and accessing GitHub Codespaces. The tool is widely used for its ability to streamline workflows and enhance productivity. However, versions 2.6.1 and earlier are vulnerable to a remote code execution flaw when using specific commands related to Codespaces.
Vulnerability Detail
The vulnerability arises from the way GitHub CLI retrieves SSH connection details from a potentially malicious devcontainer. When users execute the 'gh codespace ssh' or 'gh codespace logs' commands, the CLI uses the remote username to establish an SSH connection. If a malicious devcontainer modifies the SSH server to inject arguments into the remote username, it can lead to arbitrary code execution on the user's workstation. For instance, a remote username like '-oProxyCommand="echo hacked" #' can exploit this flaw, allowing attackers to execute unintended commands.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users should avoid connecting to untrusted or unknown devcontainers until they have updated to the patched version of GitHub CLI. Additionally, users can manually validate SSH connection details before executing commands.
Conclusion
The remote code execution vulnerability in GitHub CLI versions 2.6.1 and earlier poses a significant risk to users connecting to potentially malicious devcontainers. It is crucial to update to version 2.62.0 or later to mitigate this risk. Users should also exercise caution when connecting to unknown environments.
See every vulnerability recorded for gh →
FAQ
The vulnerability can lead to remote code execution on the user's machine, allowing attackers to execute arbitrary commands.
You can check your GitHub CLI version by running 'gh --version' in your terminal. If it is 2.6.1 or earlier, it is affected.
If you cannot update immediately, avoid using 'gh codespace ssh' or 'gh codespace logs' commands with untrusted devcontainers.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for gh.
