CVE-2023-40034: Woodpecker Webhook Validation Bypass
Summary
CVE-2023-40034: Woodpecker does not validate webhook before changing any data. Affects github.com/woodpecker-ci/woodpecker versions >= 1.0.0, < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Woodpecker is a CI (Continuous Integration) system written in Go. It is used for automating the build, test, and deployment processes of software projects. Woodpecker allows users to configure webhooks, which are HTTP callbacks that trigger actions in response to events happening in a repository. These webhooks can be used to update repository data, among other things.
Vulnerability Detail
The Woodpecker CI system does not properly validate webhook data before making changes to the repository. This means that an attacker can send malformed webhook data, leading to unauthorized updates of the repository. If the CI system is publicly accessible and connected to a public forge, this vulnerability can be critical as it could allow an attacker to take over the repository. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
go get github.com/woodpecker-ci/woodpecker@v1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, you can secure the Woodpecker CI system by making it inaccessible to untrusted entities. This can be achieved by placing the CI system behind a firewall or implementing other access control measures.
Conclusion
The Woodpecker CI system is vulnerable to a webhook validation bypass, which can lead to unauthorized updates and potential repository takeover. It is recommended to update Woodpecker to the latest version or apply the provided fix. Securing the CI system by implementing access control measures is also advised. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/woodpecker-ci/woodpecker →
FAQ
Woodpecker is a CI system used for automating software build, test, and deployment processes.
A webhook is an HTTP callback that triggers actions in response to events happening in a repository.
The vulnerability allows an attacker to send malicious webhook data, leading to unauthorized updates of the repository and potential takeover of the repository.
To fix this vulnerability, update Woodpecker to the next version or the latest v1.0 release.
Yes, you can secure the Woodpecker CI system by making it inaccessible to untrusted entities, such as by placing it behind a firewall.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/woodpecker-ci/woodpecker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
