# GHES Management console EoP (editor to site admin)

GHES management console's POST /start endpoint was reachable by editor-role users and allowed resetting the site admin password, escalating editor to site admin.

- Payout: hidden
- Severity: high
- Program: GitHub
- Found by (vendor credit): Imre Rad
- Found by: imrerad
- Disclosed: 2024-01-08
- CVE: CVE-2023-46647
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2197796
- Library page: https://bugbountylibrary.com/r/h1%3A2197796
- Tags: area:web domain:web impact:ato impact:privesc kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** GHES Management console Rails controller (Manage:App), POST /start endpoint
**Root cause:** The Manage:App controller's POST /start method lacked role restriction, so editor-role users could invoke bootstrap functionality intended for operators/admins, including site admin password reset.
**Steps:**
1. Authenticate to GHES management console with an editor-role account
2. Send `POST /start` to the Manage:App endpoint
3. Use the endpoint to reset the site admin password
4. Log in as site admin with the new credentials
**How found:** Code review of the Manage:App Rails controller revealed POST /start was accessible to editors and operators, and its functionality (license change, site admin password reset) exceeded editor privileges.
**Exploitation:** A malicious or compromised editor account calls POST /start on the management console to reset the site admin password, then authenticates as site admin for full unrestricted access to the deployment.
**Escalation:** Editor role escalated to site admin, granting unrestricted access to the GHES instance.
**Insight:** On admin consoles, enumerate every route on shared controllers and check per-action role gating rather than controller-level auth; bootstrap/start endpoints often carry privileged side effects like password resets.