CVE-2024-1378

CVE-2024-1378 is a critical command injection vulnerability in GitHub Enterprise Server (all versions prior to 3.12) that allowed an attacker with editor-level access to the Management Console to gain administrative SSH access to the appliance. The vulnerability specifically arose from improper handling of nomad templates when configuring SMTP options. With a CVSS score of 9.1 (Critical), this flaw presents a high-impact risk, enabling complete compromise of the server's confidentiality, integrity, and availability. Exploitation requires authenticated access to the Management Console with an editor role, but once achieved, it offers a straightforward path to full system control. While there is no evidence of active exploitation (KEV: No) and no public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness among security researchers. Patches are available in versions 3.11.5, 3.10.7, 3.9.10, and 3.8.15.