PT-2023-27227 · Unknown · Woodpecker

Anbraten · Published 2023-08-16 · Updated 2024-08-21 · CVE-2023-40034

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woodpecker versions prior to 1.0.2

Description An attacker can post malformed webhook data which leads to an update of the repository data, potentially allowing the takeover of a repository. This issue is critical if the CI is configured for public usage and connected to a forge that is also in public usage.

Recommendations For versions prior to 1.0.2, upgrade to version 1.0.2 or later. For users unable to upgrade, secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-40034

GHSA-4GCF-5M39-98MC

GO-2023-2014

Affected Products

Woodpecker

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40034.json · Exploit
• https://github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105 · Patch
• https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40034 · Security Note
• https://osv.dev/vulnerability/GHSA-4gcf-5m39-98mc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40034 · Vendor Advisory
• https://github.com/woodpecker-ci/woodpecker/pull/2221 · Note
• https://github.com/woodpecker-ci/woodpecker/pull/2222 · Note
• https://github.com/woodpecker-ci/woodpecker/releases/tag/v1.0.2 · Note
• https://github.com/woodpecker-ci/woodpecker · Note
• https://twitter.com/CVEnew/status/1691915979096297634 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1691944334919156031 · Twitter Post
• https://t.me/cibsecurity/68692 · Telegram Post
• https://t.me/cvenotify/57306 · Telegram Post