CVE-2024-53858: Github.com/cli/cli/v2 Recursive Repository Cloning Can Leak Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jwcm-9g39-pmcw",
  "modified" : "2024-12-02T18:03:39Z",
  "published" : "2024-11-27T21:43:05Z",
  "aliases" : [ "CVE-2024-53858" ],
  "summary" : "Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts",
  "details" : "### Summary\n\nA security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing `git` submodules hosted outside of GitHub.com and ghe.com.\n\n### Details\n\nThis vulnerability stems from several `gh` commands used to clone a repository with submodules from a non-GitHub host including `gh repo clone`, `gh repo fork`, `gh pr checkout`. These GitHub CLI commands invoke `git` with instructions to retrieve authentication tokens using the [`credential.helper`](https://git-scm.com/docs/gitcredentials) configuration variable for any host encountered.\n\nPrior to `2.63.0`, hosts other than GitHub.com and ghe.com are treated as GitHub Enterprise Server hosts and have tokens sourced from the following environment variables before falling back to host-specific tokens stored within system-specific secured storage:\n\n- `GITHUB_ENTERPRISE_TOKEN`\n- `GH_ENTERPRISE_TOKEN`\n- `GITHUB_TOKEN` _when `CODESPACES` environment variable is set_\n\nThe result being `git` sending authentication tokens when cloning submodules.\n\nIn `2.63.0`, these GitHub CLI commands will limit the hosts for which `gh` acts as a credential helper to source authentication tokens. Additionally, `GITHUB_TOKEN` will only be used for GitHub.com and ghe.com.\n\n### Impact\n\nSuccessful exploitation could lead to a third-party using leaked authentication tokens to access privileged resources.\n\n### Remediation and mitigation\n\n1. Upgrade `gh` to `2.63.0`\n2. Revoke authentication tokens used with the GitHub CLI: \n    - [Personal access tokens](https://docs.github.com/en/enterprise-cloud@latest/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)\n    - [GitHub CLI OAuth app](https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps#reviewing-your-authorized-github-apps)\n3. Review your personal [security log](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log) and any relevant [audit logs](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/identifying-audit-log-events-performed-by-an-access-token) for actions associated with your account or enterprise",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cli/cli/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.63.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.62.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cli/cli/security/advisories/GHSA-jwcm-9g39-pmcw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-53858"
  }, {
    "type" : "WEB",
    "url" : "https://git-scm.com/docs/gitcredentials"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cli/cli"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-27T21:43:05Z",
    "nvd_published_at" : "2024-11-27T22:15:05Z"
  }
}