Authentication Token Leakage in GitHub CLI (gh) - CVE-2024-53858
Summary
CVE-2024-53858: The gh cli is GitHub’s official command line tool. Affects gh versions 2.23.0+dfsg1-1 – 2.46.0-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The GitHub CLI (gh) is an official command line tool provided by GitHub that allows users to interact with GitHub repositories directly from the terminal. It simplifies workflows by enabling operations such as cloning, forking, and checking out pull requests. However, a security vulnerability has been identified that affects how the CLI handles authentication tokens when interacting with repositories that contain git submodules hosted outside of GitHub.com and ghe.com.
Vulnerability Detail
The vulnerability arises from the way the GitHub CLI invokes git commands to clone repositories with submodules from non-GitHub hosts. Specifically, commands like 'gh repo clone', 'gh repo fork', and 'gh pr checkout' can inadvertently leak authentication tokens. Prior to version 2.63.0, the CLI treated all hosts other than GitHub.com and ghe.com as GitHub Enterprise Server hosts, leading to the retrieval of tokens from environment variables such as GITHUB_ENTERPRISE_TOKEN, GH_ENTERPRISE_TOKEN, and GITHUB_TOKEN. This behavior can result in unauthorized access to sensitive information, as git may send these tokens when cloning submodules.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to revoke any authentication tokens used with the GitHub CLI and to avoid using the CLI for cloning repositories with submodules from non-GitHub hosts until the upgrade is completed.
Conclusion
In summary, CVE-2024-53858 represents a significant security concern for users of the GitHub CLI, particularly when dealing with repositories that include git submodules from non-GitHub hosts. Users are strongly encouraged to upgrade to the latest version of the CLI and to take necessary precautions to protect their authentication tokens.
See every vulnerability recorded for gh →
FAQ
CVE-2024-53858 is a security vulnerability in the GitHub CLI that can leak authentication tokens when cloning repositories with git submodules from non-GitHub hosts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you suspect that you have been affected, revoke your authentication tokens and review your personal security log and audit logs for any suspicious activity.
Yes, upgrading to GitHub CLI version 2.63.0 or later addresses this vulnerability.
The potential risks include unauthorized access to repositories and sensitive information due to the unintended leakage of authentication tokens.
Related vulnerabilities
Recent vulnerabilities recorded for gh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
