CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker
Attackers can inject malicious environment variables to alter plugin execution, leading to host takeover or secret extraction in Woodpecker CI/CD.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41122?
CVE-2024-41122 is a high-severity code injection vulnerability in woodpecker-ci woodpecker, published on 19 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten. This issue has been addressed in release version 2.7.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-74
Which versions are affected by CVE-2024-41122?
6 open source packages ship an affected version, including go.woodpecker-ci.org/woodpecker and go.woodpecker-ci.org/woodpecker/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go.woodpecker-ci.org/woodpecker Go | All versions | None |
go.woodpecker-ci.org/woodpecker Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker/v2 Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker/v2 Go | All versions | 2.7.0 |
go.woodpecker-ci.org/woodpecker/v2 Go | All versions | 2.7.0 |
Products include Woodpecker-Ci Woodpecker.
How do I fix CVE-2024-41122?
Upgrade go.woodpecker-ci.org/woodpecker to 2.7.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-41122 being exploited?
There is no known exploitation of CVE-2024-41122 in the wild and no public exploit code.
Other vulnerabilities in woodpecker-ci woodpecker
Sources
Also known as GHSA-3wf2-2pq4-4rvc, GO-2024-2998.