CVE-2022-29947: Cross-Site Scripting (XSS) in Woodpecker
Summary
CVE-2022-29947: Woodpecker allows cross-site scripting (XSS) via build logs. Affects github.com/woodpecker-ci/woodpecker versions < 0.15.1. Fixed in 0.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Woodpecker is a Go-based package used for continuous integration and delivery. It provides a platform for automating build, test, and deployment processes. The package is widely used in software development workflows to streamline the development and release cycles. However, a vulnerability has been discovered in Woodpecker that allows for cross-site scripting (XSS) attacks via build logs.
Vulnerability Detail
The vulnerability (CVE-2022-29947) in Woodpecker arises from a lack of proper escaping in the 'BuildLog.vue' component. This allows an attacker to inject malicious scripts into the build logs, which can be executed when viewed by other users. The impact of this vulnerability can range from unauthorized data access to full control over user sessions, depending on the specific payload injected. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.15.1
This is the first release that contains the fix.
go get github.com/woodpecker-ci/woodpecker@v0.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the build logs to remove any potentially malicious scripts. This can be done by implementing a script sanitization function that filters out or escapes any HTML or JavaScript tags and special characters. Here is an example of a sanitization function in JavaScript:
function sanitizeLogs(logs) {
// Remove script tags
logs = logs.replace(/<script.*?>.*?</script>/gi, '');
// Escape special characters
logs = logs.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');
return logs;
}
Conclusion
The Woodpecker package is vulnerable to cross-site scripting (XSS) attacks via build logs. It is crucial to upgrade to version 0.15.1 or later to mitigate this vulnerability. In the meantime, users can implement a temporary workaround by sanitizing the build logs to remove any potentially malicious scripts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/woodpecker-ci/woodpecker →
FAQ
Woodpecker is a Go-based package used for continuous integration and delivery. It automates build, test, and deployment processes in software development workflows.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized data access, session hijacking, and other malicious activities.
The Woodpecker vulnerability allows attackers to inject malicious scripts into build logs, which can be executed when viewed by other users. This can lead to unauthorized data access, session hijacking, and other malicious activities.
The Woodpecker vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
To fix the Woodpecker vulnerability, it is recommended to upgrade to version 0.15.1 or later, which includes proper escaping of build logs in the 'BuildLog.vue' component.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/woodpecker-ci/woodpecker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
