« Volver al listado

CVE-2025-11578

Estado: AnalizadaAlta (7.5)—

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user’s authorized keys—thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges.

Leer descripción completaMostrar menos

This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso autenticado a servicio remoto (GHE Server) requiriendo privilegios administrativos (PR:H). Escalada local mediante symlink en hook. Impactos: root SSH (escalada T1068) y adición de clave SSH autorizada (T1098.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

Github — Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-11578",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11578",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-12T17:33:22.593181Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "product-cna@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "product-cna@github.com",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "Enterprise Server",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.14.20",
                  "status": "unaffected"
                }
              ],
              "version": "3.14",
              "versionType": "semver",
              "lessThanOrEqual": "3.14.19"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.15.15",
                  "status": "unaffected"
                }
              ],
              "version": "3.15",
              "versionType": "semver",
              "lessThanOrEqual": "3.15.14"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.16.11",
                  "status": "unaffected"
                }
              ],
              "version": "3.16",
              "versionType": "semver",
              "lessThanOrEqual": "3.16.10"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.17.8",
                  "status": "unaffected"
                }
              ],
              "version": "3.17",
              "versionType": "semver",
              "lessThanOrEqual": "3.17.7"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "3.18.2",
                  "status": "unaffected"
                }
              ],
              "version": "3.18",
              "versionType": "semver",
              "lessThanOrEqual": "3.18.1"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-11-10T23:15:41.193",
  "references": [
    {
      "url": "https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.20",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.15",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.11",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.8",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    },
    {
      "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.2",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "product-cna@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "product-cna@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user’s authorized keys—thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program."
    }
  ],
  "lastModified": "2026-06-17T08:30:44.290",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43EB11CA-6023-4B6E-824F-BC1E3B38BBC8",
              "versionEndExcluding": "3.14.20",
              "versionStartIncluding": "3.14.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F3CBE73-32C5-4F1A-A660-3016FA77E633",
              "versionEndExcluding": "3.15.15",
              "versionStartIncluding": "3.15.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "754773B0-BDEC-497C-91A7-F542A74C4414",
              "versionEndExcluding": "3.16.11",
              "versionStartIncluding": "3.16.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C3E38F9-7310-4901-90A8-C0BEAFA8A092",
              "versionEndExcluding": "3.17.8",
              "versionStartIncluding": "3.17.0"
            },
            {
              "criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9751597D-AD87-4C92-83EC-87D2474410C5",
              "versionEndExcluding": "3.18.2",
              "versionStartIncluding": "3.18.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-cna@github.com"
}