CyberWatch

Critical SAML SSO Vulnerability in GitHub Enterprise Server

By

Matthew Fagan and Alexander Marshall, Access Point Consulting

By

Access Point Consulting

Summary

GitHub has remediated an authentication bypass vulnerability under CVE-2024-4985 (CVSSv4: 10.0). This vulnerability allows an attacker to use SAML single sign-on (SSO) authentication to sign in as a user with administrator privileges. This affects GitHub Enterprise Server (GHES) versions prior to 3.13.0 that use SAML SSO with encrypted assertions.

Impact Assessment

  • CVSS Score: 10.0 (Critical)
  • Affected Versions: GHES prior to 3.13.0
  • Conditions: Only affects instances with SAML SSO and encrypted assertions enabled.

Urgency

This vulnerability requires immediate attention due to its severity and potential for exploitation.

Remediation

  • Fixed Versions: 3.9.15, 3.10.12, 3.11.10, 3.12.4, and upcoming 3.13.0.
  • Upgrade Guide: GitHub Docs


Business Implications

Exploitation could lead to unauthorized access, data exfiltration, and injection of malicious code, resulting in significant data, monetary, and reputational loss.

Recommendations

  • Patch: Upgrade to the latest GHES version immediately.
  • Mitigate: Disable encrypted assertions until the upgrade is completed.

Communication Plan

  • Stakeholders: Inform security teams, IT operations, and executive management about the urgency and impact.
  • Internal Notification: Use provided templates to communicate the required actions to all relevant teams.

Associated Bulletin

For more information or assistance, contact:

Resources

Latest Resources

Resources

CyberWatch

April 2, 2025

Scott "Monty" Montgomery (Island) | Navigating CMMC compliance for organizations of every size

Scott Montgomery, known as Monty, joined the CyberWatch Expert Series podcast to discuss his extensive background in cybersecurity, particularly in building and designing network security tools for high-assurance environments like the Department of Defense (DoD) and the intelligence community. His experience includes significant tenure at McAfee (now Trellix), which led him to his current role at Island, where he focuses on innovative approaches to cybersecurity compliance.

Find out more
March 19, 2025

Michael Sviben (DomainGuard) | Defending against phishing and building proactive security awareness

Cybersecurity threats evolve rapidly, and one tactic consistently rises above the rest: phishing. In this episode of CyberWatch, Michael Sviben, co-founder of DomainGuard, discusses why phishing remains so effective, how businesses and individuals become targets, and what you can do to stay vigilant.

Find out more
March 5, 2025

David Habib (Brightspot) | Building a culture of cybersecurity awareness

Cybersecurity awareness is often reduced to check-the-box training, but David Habib, CIO at Brightspot, argues that real security awareness isn’t about formal programs—it’s about making security part of a company’s culture. In this episode, he shares practical insights on how organizations can move beyond stale training sessions to create an engaged and security-conscious workforce.

Find out more