Unsafe reflection RCE in GitHub Enterprise Server organizations actions settings

This repository contains two Python exploit scripts targeting critical vulnerabilities in GitHub Enterprise Server: CVE-2024-0200 and CVE-2024-0507. The structure is straightforward, with each exploit in its own file (CVE-2024-0200.py and CVE-2024-0507.py), a README.md with background and references, and an assets directory for images. CVE-2024-0200.py exploits an unsafe reflection vulnerability that allows an attacker with organization owner credentials to leak the ENTERPRISE_SESSION_SECRET and craft a malicious session cookie. This cookie, when sent to the server, triggers a Ruby Marshal deserialization vulnerability, resulting in remote code execution (RCE) as the server. The payload opens a reverse shell to an attacker-controlled IP and port. CVE-2024-0507.py exploits a command injection vulnerability in the management console's storage settings. By injecting a command into a POST parameter, the attacker can reset the root site admin password to a known value, effectively escalating privileges to site admin. The script automates login, CSRF token handling, payload delivery, and status checking. Both exploits require valid credentials and target network-accessible endpoints on the GitHub Enterprise Server web interface. The code is operational, automating the full exploitation process for each CVE. No fake or detection-only scripts are present.