go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise Server. Prior to version `2.11.1`, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN` environment variable for a host other than GitHub.com or ghe.com when within a codespace. In version `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for GitHub.com or ghe.com hosts. Successful exploitation could send authentication token to an unintended host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also advised to regenerate authentication tokens and to review their personal security log and any relevant audit logs for actions associated with their account or enterprise.

The version of gh installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53859 advisory.

  - go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A     security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for     GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from     different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for     GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise     Server. Prior to version `2.11.1`, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN`     environment variable for a host other than GitHub.com or ghe.com when within a codespace. In version     `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for     GitHub.com or ghe.com hosts. Successful exploitation could send authentication token to an unintended     host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also     advised to regenerate authentication tokens and to review their personal security log and any relevant     audit logs for actions associated with their account or enterprise. (CVE-2024-53859)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7362-1 advisory.

    It was discovered that go-gh incorrectly handled authentication tokens. An attacker could possibly use     this issue to leak

    authentication tokens to the wrong host. (CVE-2024-53859)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A     security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for     GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from     different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for     GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise     Server. Prior to version `2.11.1`, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN`     environment variable for a host other than GitHub.com or ghe.com when within a codespace. In version     `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for     GitHub.com or ghe.com hosts. Successful exploitation could send authentication token to an unintended     host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also     advised to regenerate authentication tokens and to review their personal security log and any relevant     audit logs for actions associated with their account or enterprise. (CVE-2024-53859)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - go-gh is a Go module for interacting with the `gh` utility and the GitHub API from the command line. A
    security vulnerability has been identified in `go-gh` that could leak authentication tokens intended for
    GitHub hosts to non-GitHub hosts when within a codespace. `go-gh` sources authentication tokens from
    different environment variables depending on the host involved: 1. `GITHUB_TOKEN`, `GH_TOKEN` for
    GitHub.com and ghe.com and 2. `GITHUB_ENTERPRISE_TOKEN`, `GH_ENTERPRISE_TOKEN` for GitHub Enterprise
    Server. Prior to version `2.11.1`, `auth.TokenForHost` could source a token from the `GITHUB_TOKEN`
    environment variable for a host other than GitHub.com or ghe.com when within a codespace. In version
    `2.11.1`, `auth.TokenForHost` will only source a token from the `GITHUB_TOKEN` environment variable for
    GitHub.com or ghe.com hosts. Successful exploitation could send authentication token to an unintended
    host. This issue has been addressed in version 2.11.1 and all users are advised to upgrade. Users are also
    advised to regenerate authentication tokens and to review their personal security log and any relevant
    audit logs for actions associated with their account or enterprise. (CVE-2024-53859)

ID	Name	Product	Family	Severity
296068	Azure Linux 3.0 Security Update: gh (CVE-2024-53859)	Nessus	Azure Linux Local Security Checks	high
233058	Ubuntu 24.04 LTS / 24.10 : go-gh vulnerability (USN-7362-1)	Nessus	Ubuntu Local Security Checks	medium
232167	Linux Distros Unpatched Vulnerability : CVE-2024-53859	Nessus	Misc.	high
410602	SCA: security update for github.com/cli/go-gh/v2 (GHSA-55v3-xh23-96gh)	Tenable Cloud Security	SCA Checks	high
410602	SCA: security update for github.com/cli/go-gh/v2 (GHSA-55v3-xh23-96gh)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-53859

high

Tenable Plugins

high

medium

high

high

high