GitHub: Unauthorized SSH Certificate Authority or Requirement Modification

GitHub organizations and enterprises can utilize SSH certificate authorities (CAs) to issue short-lived SSH certificates, mandating their use in place of personal SSH keys for Git access. This configuration centralizes access control and enforces time-bounded authentication. Unauthorized modifications to these settings, specifically the creation or destruction of a CA or the disabling of certificate requirements, significantly weaken access controls. Following an account takeover, an adversary may perform these actions to authenticate using unmanaged SSH keys, bypassing the organization's intended security posture.

Impact

Successful unauthorized modification of SSH certificate requirements allows an adversary to authenticate to organizational repositories using persistent, unmanaged SSH keys. This weakens Git access control, bypasses centralized and time-bounded authentication policies, and provides a mechanism for sustained persistence and defense evasion.

Recommendation

• Audit GitHub audit logs for ssh_certificate_authority.create, ssh_certificate_authority.destroy, and ssh_certificate_requirement.disable events.
• Restrict administrative privileges for managing SSH CAs and certificate requirements to a minimal set of trusted, highly monitored owner accounts.
• Implement automated alerting for any modification to SSH CA configurations or disabling of SSH certificate requirements.
• If unauthorized modifications are detected, immediately re-enable certificate requirements, restore the intended CA configuration, revoke any SSH keys added during the window of vulnerability, and rotate credentials for compromised accounts.