CVE-2024-53858

Summary

CVE-2024-53858 is a vulnerability affecting the GitHub CLI, which could lead to the leakage of authentication tokens when cloning repositories with `git` submodules hosted outside of GitHub.com and ghe.com. This issue arises due to several GitHub CLI commands, including `gh repo clone`, `gh repo fork`, and `gh pr checkout`, that invoke `git` to retrieve authentication tokens using the `credential.helper` configuration variable. Before version 2.63.0, these commands treated non-GitHub hosts as GitHub Enterprise Server hosts and sourced tokens from specific environment variables. As a result, `git` sent authentication tokens when cloning submodules, posing a serious security risk. Version 2.63.0 of the GitHub CLI mitigates this vulnerability by limiting the hosts for which `gh` acts as a credential helper to source authentication tokens. Furthermore, `GITHUB_TOKEN` is now only used for GitHub.com and ghe.com. Users are strongly advised to upgrade to this version and revoke any previously used authentication tokens. It is also recommended to review personal security logs and relevant audit logs for any suspicious activity.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.