The notebook viewer component in GitHub Enterprise Server improperly validated user-supplied URLs by checking only the scheme and host but not the port. This allowed SSRF attacks targeting internal services on different ports of the same appliance. Although response bodies were not returned, timing differences allowed attackers to extract instance secrets character by character. These secrets could then be leveraged to interact with internal services to gain remote code execution on the appliance. The vulnerability affects versions 3.17 through 3.22 and was reported via the GitHub Bug Bounty program. It requires network access to the instance and varies in authentication requirements depending on private mode settings.

Successful exploitation can lead to disclosure of sensitive instance secrets and remote code execution on the GitHub Enterprise Server appliance. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 9.8, indicating high impact and ease of exploitation under the stated conditions.

Fixes are available in GitHub Enterprise Server versions 3.22.1, 3.21.6, 3.20.8, 3.19.12, 3.18.15, and 3.17.21. Users should upgrade to one of these patched versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these official updates.