PT-2024-29278 · Unknown · Woodpecker

D_K_Dev + 3 · Published 2024-07-19 · Updated 2024-11-15 · CVE-2024-41122

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Woodpecker versions prior to 2.7.0

Description The issue allows attackers to create malicious workflows that can lead to host takeover or secret leaks. This is possible because the server allows any user to trigger a pipeline run, and those workflows can either take over the host running the agent or extract secrets normally provided to plugins. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 2.7.0, upgrade to release version 2.7.0 to address the issue. As a temporary workaround, enable the "gated" repo feature and review each change upfront of running. There are no other known workarounds for this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-41122

GHSA-3WF2-2PQ4-4RVC

GO-2024-2998

Affected Products

Woodpecker

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41122.json · Exploit
• https://github.com/woodpecker-ci/woodpecker/pull/3909 · Patch
• https://github.com/woodpecker-ci/woodpecker/issues/3929 · Patch
• https://github.com/woodpecker-ci/woodpecker/pull/3934 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-41122 · Security Note
• https://osv.dev/vulnerability/GHSA-3wf2-2pq4-4rvc · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2998 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-41122 · Vendor Advisory
• https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc · Note
• https://github.com/woodpecker-ci/woodpecker/commit/8aa3e5ec82c92eca3279e4be68625111eeedf1c4 · Note
• https://github.com/woodpecker-ci/woodpecker · Note
• https://t.me/cvenotify/96887 · Telegram Post
• https://twitter.com/socialmanagercs/status/1857456913287729233 · Twitter Post
• ❌ https://github.com/woodpecker-ci/woodpecker-security/issues/10 · Note, Deleted
• https://t.me/cvedetector/1233 · Telegram Post