CVE-2024-41121CWE-74

Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker

High · published July 19, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00737 · 54.0th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2024-07-19T19:57Z
EPSS history
Timeline
  • 19 JUL 19:57Z
    Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
    cvelistv5