Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new

Summary

Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user interaction and social engineering to make changes to a user account via CSP bypass with created CSRF tokens. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in all versions of 3.11.5, 3.10.7, 3.9.10, and 3.8.15. CVE-2024-1084

@ros876 found an HTML injection vulnerability in GitHub's tag protection settings page. The vulnerability occurred when an error response from the check_pattern endpoint got injected directly into the DOM via innerHTML without proper sanitization. Exploitation required the victim to "drag-and-drop" a payload into a textbox, @sudi helped set up the POC for this. The CSP on github.com prevented any script execution from the injected HTML, but @joaxcar proved that an attacker could still perform sensitive actions using a combination of "on-site" script gadgets