InfoSecBulletin Cybersecurity for mankind
A security vulnerability (CVE-2024-52308) in the GitHub Command Line Interface (CLI) could allow remote code execution on users’ devices. With a CVSS score of 8.1, this highlights the need for developers to stay vigilant with software updates and security measures.
The vulnerability arises from how the gh CLI handles SSH connection details with GitHub Codespaces, which uses SSH for secure communication between the local machine and the remote environment.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
According to GitHub’s security advisory, “This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects ssh arguments within the SSH connection details. gh codespace ssh and gh codespace logs commands could execute arbitrary code on the user’s workstation if the remote username contains something like -oProxyCommand=”echo hacked” #.“
If a user connects to a compromised Codespace, the malicious SSH server has the capability to manipulate connection details and inject arbitrary commands. This could result in those commands being executed on the user’s machine, which may lead to severe consequences such as data breaches, system compromises, or even escalated malicious activities.
A successful exploit allows remote code execution (RCE) on a victim’s workstation, which can compromise the system, expose sensitive data, and lead to further attacks.According to GitHub, “Successful exploitation could lead to arbitrary code execution on the user’s workstation, potentially compromising the user’s data and system.”
GitHub has quickly fixed this vulnerability by releasing gh CLI version 2.62.0. Please upgrade to this version immediately.
Furthermore, GitHub advises developers to exercise caution when utilizing custom devcontainer images. “Prefer default or pre-built devcontainers from trusted sources,” the advisory recommends, emphasizing the importance of secure development practices.
Hacker offers “Popular Life Insurance” 36 GB of stolen data for sale
