CVE-2024-41121 Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker
Attackers can overwrite plugin entrypoints in Woodpecker CI/CD to execute arbitrary code on agents or steal secrets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41121?
CVE-2024-41121 is a high-severity code injection vulnerability in woodpecker-ci woodpecker, published on 19 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-74
Which versions are affected by CVE-2024-41121?
6 open source packages ship an affected version, including go.woodpecker-ci.org/woodpecker and go.woodpecker-ci.org/woodpecker/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go.woodpecker-ci.org/woodpecker Go | All versions | None |
go.woodpecker-ci.org/woodpecker Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker/v2 Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker/v2 Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker/v2 Go | All versions | 2.7.0 |
Products include Woodpecker-Ci Woodpecker.
How do I fix CVE-2024-41121?
Upgrade go.woodpecker-ci.org/woodpecker to 2.7.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-41121 being exploited?
There is no known exploitation of CVE-2024-41121 in the wild and no public exploit code.
Other vulnerabilities in woodpecker-ci woodpecker
Sources
Also known as GHSA-xw35-rrcp-g7xm, GO-2024-2999.