{"id":"UBUNTU-CVE-2024-52308","details":"The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand=\"echo hacked\" #`.  The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used.","modified":"2026-02-04T07:58:05.353415Z","published":"2024-11-14T23:15:00Z","related":["USN-7130-1"],"upstream":["CVE-2024-52308"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-52308"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2024-52308"},{"type":"REPORT","url":"https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-7130-1"}],"affected":[{"package":{"name":"gh","ecosystem":"Ubuntu:Pro:24.04:LTS","purl":"pkg:deb/ubuntu/gh@2.45.0-1ubuntu0.2+esm1?arch=source&distro=esm-apps/noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.45.0-1ubuntu0.2+esm1"}]}],"versions":["2.27.0+dfsg1-1build1","2.30.0-2","2.35.0-1","2.40.1+dfsg1-1","2.42.1-1","2.43.1-1","2.44.1-1","2.44.1-2","2.45.0-1","2.45.0-1build1","2.45.0-1ubuntu0.1","2.45.0-1ubuntu0.2"],"ecosystem_specific":{"priority_reason":"code execution","availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_version":"2.45.0-1ubuntu0.2+esm1","binary_name":"gh"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52308.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"},{"type":"Ubuntu","score":"high"}]}