GHSA-xw35-rrcp-g7xmHighCVSS 8.8
Woodpecker's custom workspace allow to overwrite plugin entrypoint executable
🔗 CVE IDs covered (1)
📋 Description
Impact
The server allow to create any user who can trigger a pipeline run malicious workflows:
- Those workflows can either lead to a host takeover that runs the agent executing the workflow.
- Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.
Patches
https://github.com/woodpecker-ci/woodpecker/pull/3933
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? Enable the "gated" repo feature and review each change upfront
References
- https://github.com/woodpecker-ci/woodpecker/pull/3933
- https://github.com/woodpecker-ci/woodpecker-security/pull/11
- https://github.com/woodpecker-ci/woodpecker-security/issues/8 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924)
- https://github.com/woodpecker-ci/woodpecker-security/issues/9 (info will be published later at https://github.com/woodpecker-ci/woodpecker/issues/3924)
- https://github.com/woodpecker-ci/woodpecker/issues/3924 (info will be published later once we got adoption of the update)
Credits
🎯 Affected products2
- go/go.woodpecker-ci.org/woodpecker/v2:< 2.7.0
- go/go.woodpecker-ci.org/woodpecker:< 2.7.0
🔗 References (10)
- https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-xw35-rrcp-g7xm
- https://github.com/woodpecker-ci/woodpecker/issues/3924
- https://github.com/woodpecker-ci/woodpecker/pull/3933
- https://github.com/woodpecker-ci/woodpecker/commit/764329ed1dbc47c4a517ccc749e3feb34059fac8
- https://nvd.nist.gov/vuln/detail/CVE-2024-41121
- https://github.com/woodpecker-ci/woodpecker-security/issues/8
- https://github.com/woodpecker-ci/woodpecker-security/issues/9
- https://github.com/woodpecker-ci/woodpecker-security/pull/11
- https://pkg.go.dev/vuln/GO-2024-2999
- https://github.com/advisories/GHSA-xw35-rrcp-g7xm