Woodpecker does not validate webhook before changing any data

CAO 8.1CVE-2023-40034 · GHSA-4gcf-5m39-98mc · GO-2023-2014 · Công bố 16/08/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-40034 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng github.com/woodpecker-ci/woodpecker, woodpecker (woodpecker-ci).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.88%, cao hơn 59.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.0.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/woodpecker-ci/woodpecker Go	`≥ 1.0.0, < 1.0.2`	`1.0.2`
woodpecker woodpecker-ci	`≥ 1.0.0, < 1.0.2`	`1.0.2`

Mô tả

Impact

An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage.

Patches

Please use either next or the latest v1.0 e.g. v1.0.2

Workarounds

Secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.

References

Fix: https://github.com/woodpecker-ci/woodpecker/pull/2221 Backport: https://github.com/woodpecker-ci/woodpecker/pull/2222

Mô tả của NVD

Woodpecker is a community fork of the Drone CI system. In affected versions an attacker can post malformed webhook data witch lead to an update of the repository data that can e.g. allow the takeover of an repo. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. This issue has been addressed in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.