Vulnerability · Published Aug 16, 2023 · Assigned by GitHub_M
CVE-2023-40034Repositoty takeover in woodpecker-ci
High 8.1
In plain English
A high-severity improper input validation in woodpecker from woodpecker-ci. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. This issue has been addressed in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/woodpecker-ci/woodpecker | 1.0.2 | GHSA-4gcf-5m39-98mc |
| Go | github.com/woodpecker-ci/woodpecker | 1.0.2 | GO-2023-2014 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| woodpecker-ci | woodpecker | >= 1.0.0, < 1.0.2 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-4gcf-5m39-98mc x_refsource_CONFIRM
- https://github.com/woodpecker-ci/woodpecker/pull/2221 x_refsource_MISC
- https://github.com/woodpecker-ci/woodpecker/pull/2222 x_refsource_MISC
- https://github.com/woodpecker-ci/woodpecker/commit/6e4c2f84cc84661d58cf1c0e5c421a46070bb105 x_refsource_MISC