CVE-2024-52308: Command Execution Vulnerability in github.com/cli/cli via Malicious Codespaces
Summary
CVE-2024-52308: Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer in github.com/cli/cli. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- gh · Debian:12
- github.com/cli/cli/v2 · Go
The same CVE-2024-52308 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/cli/cli package is a command-line interface for GitHub, enabling users to interact with GitHub repositories and perform various tasks directly from the terminal. It is widely used for its convenience and integration with GitHub's features. However, this package is vulnerable to a security issue that arises when connecting to potentially malicious Codespaces, which could lead to unauthorized command execution on the user's machine.
Vulnerability Detail
The vulnerability stems from the ability of the GH CLI to connect to Codespaces, which are cloud-based development environments provided by GitHub. If a user connects to a malicious Codespace, it could execute arbitrary commands on the user's local machine, leading to severe security risks such as data theft, system compromise, or unauthorized access to sensitive information. This issue is particularly concerning as it exploits the trust users place in the GitHub CLI and the Codespaces feature.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users should avoid connecting to unknown or untrusted Codespaces. Always verify the source of the Codespace before establishing a connection to minimize the risk of executing malicious commands.
Conclusion
CVE-2024-52308 is a significant vulnerability in the github.com/cli/cli package that can lead to command execution on a user's machine when connecting to malicious Codespaces. Users are advised to update to version 2.62.0 or later to mitigate this risk and to exercise caution when connecting to Codespaces.
See every vulnerability recorded for github.com/cli/cli →
FAQ
CVE-2024-52308 is a vulnerability in the github.com/cli/cli package that allows command execution on a user's computer when connecting to a malicious Codespace.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to analyze your Gopkg.lock file without any signup.
If you cannot update the package right away, avoid connecting to untrusted Codespaces as a temporary workaround to protect your system.
Codespaces are cloud-based development environments provided by GitHub that allow developers to work on their projects from anywhere. However, they can pose security risks if not used cautiously.
More information about CVE-2024-52308 can be found at the official Go vulnerability database: https://pkg.go.dev/vuln/GO-2024-3269.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cli/cli.
