CVE-2024-41122
📋 TL;DR
This vulnerability in Woodpecker CI/CD allows any user to create malicious workflows that can lead to host takeover of the agent executing the workflow or extraction of secrets from plugins. It affects all Woodpecker installations with user registration enabled. The issue has been fixed in version 2.7.0.
💻 Affected Systems
- Woodpecker CI/CD
📦 What is this software?
Woodpecker by Woodpecker Ci
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the host running the Woodpecker agent, allowing attacker persistence, lateral movement, and data exfiltration.
Likely Case
Unauthorized pipeline execution leading to resource abuse, secret leakage, and potential privilege escalation within the CI/CD environment.
If Mitigated
Limited impact with proper network segmentation and minimal secrets exposure, but still allowing unauthorized workflow execution.
🎯 Exploit Status
Exploitation requires user account creation capability but is straightforward once an account exists. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.0
Vendor Advisory: https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc
Restart Required: Yes
Instructions:
1. Backup your Woodpecker configuration and data. 2. Stop the Woodpecker service. 3. Update to version 2.7.0 using your package manager or by downloading from GitHub releases. 4. Restart the Woodpecker service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable user registration
allTemporarily disable new user registration to prevent account creation by attackers
Set WOODPECKER_REGISTRATION_CLOSED=true in environment variables or configuration
Restrict pipeline permissions
allImplement strict pipeline approval workflows and limit who can trigger pipelines
Configure Woodpecker pipeline approval settings in your configuration
🧯 If You Can't Patch
- Disable user registration completely and audit all existing user accounts
- Implement network segmentation to isolate Woodpecker agents from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check if Woodpecker version is below 2.7.0 and user registration is enabledCheck Version:
woodpecker-server --version or check container image tagVerify Fix Applied:
Verify Woodpecker version is 2.7.0 or higher and test that malicious workflow creation is prevented📡 Detection & Monitoring
Log Indicators:
- Unauthorized user creation events
- Unusual pipeline execution patterns
- Workflow steps attempting to access host resources
Network Indicators:
- Unexpected outbound connections from Woodpecker agents
- Traffic to unusual destinations from CI/CD environment
SIEM Query:
source="woodpecker" AND (event="user_created" OR event="pipeline_started") | stats count by user, pipeline🔗 References
- https://github.com/woodpecker-ci/woodpecker-security/issues/10
- https://github.com/woodpecker-ci/woodpecker/issues/3929
- https://github.com/woodpecker-ci/woodpecker/pull/3909
- https://github.com/woodpecker-ci/woodpecker/pull/3934
- https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc
- https://github.com/woodpecker-ci/woodpecker-security/issues/10
- https://github.com/woodpecker-ci/woodpecker/issues/3929
- https://github.com/woodpecker-ci/woodpecker/pull/3909
- https://github.com/woodpecker-ci/woodpecker/pull/3934
- https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc
