CVE-2021-39133 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

What is CVE-2021-39133?

CVE-2021-39133 is a high-severity vulnerability in rundeck, published on 30 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.

Weakness: CWE-352

Which versions are affected by CVE-2021-39133?

4 open source packages ship an affected version, including org.rundeck:rundeck-core. It affects 1 product.

Products include Pagerduty Rundeck.

How do I fix CVE-2021-39133?

Upgrade org.rundeck:rundeck-core to a fixed version for your release line: 3.3.14 or 3.4.3.

Is CVE-2021-39133 being exploited?

There is no known exploitation of CVE-2021-39133 in the wild and no public exploit code.

Other vulnerabilities in rundeck

• CVE-2022-29186 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise Critical 9.1
• CVE-2021-39132 YAML deserialization can run untrusted code High 8.8
• CVE-2023-48222 Authenticated users can view or delete jobs they do not have authorization for in Rundeck High 8.1
• CVE-2021-41112 Missing Authorization in Rundeck High 8.1
• CVE-2022-31044 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3jmw-c69h-426c.