GitHub Git Push Remote Code Execution | MSSP Advisory

A critical RCE vulnerability in GitHub allowed authenticated attackers to execute arbitrary code on GitHub.com and Enterprise Server instances by crafting malicious git push operations. The flaw exploited GitHub's backend Git processing pipeline through an internal component called X-STAT. GitHub patched the issue on their hosted platform and released Enterprise Server fixes, but Wiz found 88% of Enterprise instances remained vulnerable at disclosure time.

Your MSSP likely stores client code, documentation, and automation scripts in GitHub repositories that could be compromised through this attack vector. Any clients running GitHub Enterprise Server instances are exposed to remote code execution that could provide attackers with persistent access to their development environments and source code repositories.

📬