PT-2023-27227 · Unknown · Woodpecker

Anbraten · Publicado 2023-08-16 · Atualizado 2024-08-21 · CVE-2023-40034

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woodpecker versions prior to 1.0.2

Description An attacker can post malformed webhook data which leads to an update of the repository data, potentially allowing the takeover of a repository. This issue is critical if the CI is configured for public usage and connected to a forge that is also in public usage.

Recommendations For versions prior to 1.0.2, upgrade to version 1.0.2 or later. For users unable to upgrade, secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-40034

GHSA-4GCF-5M39-98MC

GO-2023-2014

Produtos afetados

Woodpecker

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40034.json · Exploit
• https://github.com/woodpecker-ci/woodpecker/pull/2221 · Nota
• https://github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105 · Correção
• https://github.com/woodpecker-ci/woodpecker/pull/2222 · Nota
• https://github.com/woodpecker-ci/woodpecker/releases/tag/v1.0.2 · Nota
• https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc · Aviso do Fabricante
• https://github.com/woodpecker-ci/woodpecker · Nota
• https://osv.dev/vulnerability/GO-2023-2014 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40034 · Nota de Segurança
• https://twitter.com/CVEnew/status/1691915979096297634 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1691944334919156031 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4gcf-5m39-98mc · Aviso do Fabricante
• https://t.me/cibsecurity/68692 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40034 · Aviso do Fabricante
• https://t.me/cvenotify/57306 · Publicação no Telegram