SecBoard
Zurück zur CVE-Übersicht

CVE-2026-110288

NONE
Risk Signal Score5/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 3.19.14
  • 3.20.10
  • 3.21.8
  • 3.22.3

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceEvents
| where ActionType == "HttpRequest" and RemoteUrl contains "/management_console/integrations/chatops/" and RequestMethod == "GET"
| where InitiatingProcessCommandLine contains "curl" or InitiatingProcessCommandLine contains "wget" or InitiatingProcessCommandLine contains "powershell" // Example for detecting suspicious GET requests
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessId

Splunk SPL

sourcetype=github_enterprise_server (uri_path="/management_console/integrations/chatops/" AND method="GET")
| search NOT (user_agent="*GitHub-Management-Console-Internal*") // Exclude legitimate internal requests if identifiable
| table _time, host, source, user, uri_path, method, client_ip

Sigma

title: GitHub Enterprise Server ChatOps CSRF
author: SecBoard
date: 2024/07/30
logsource:
  product: github_enterprise_server
  service: management_console
detection:
  selection:
    uri_path: '/management_console/integrations/chatops/'
    method: 'GET'
  condition: selection
fields:
  - user
  - client_ip
  - uri_path
  - method
tags:
  - attack.initial_access
  - cve.2026-110288
level: medium

Elastic ES|QL

from logs-github.enterprise_server-*
| where url.path == "/management_console/integrations/chatops/" and http.request.method == "GET"
| where not user_agent.original : "*GitHub-Management-Console-Internal*" // Adjust based on actual logs for internal requests
| project @timestamp, host.name, user.name, url.path, http.request.method, source.ip

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen