x/vulndb: potential Go vuln in go.woodpecker-ci.org/woodpecker: GHSA-3wf2-2pq4-4rvc

[GoVulnBot]

Advisory GHSA-3wf2-2pq4-4rvc references a vulnerability in the following Go modules:

Module
go.woodpecker-ci.org/woodpecker
go.woodpecker-ci.org/woodpecker/v2

Description:

Impact

The server allow to create any user who can trigger a pipeline run malicious workflows:

• Those workflows can either lead to a host takeover that runs the agent executing the workflow.
• Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.

Patches

woodpecker-ci/woodpecker#3909
woodpecker-ci/woodpecker#3934

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?
**Enable the "gated" repo feature and review each change upfront of ...

References:

• ADVISORY: GHSA-3wf2-2pq4-4rvc
• ADVISORY: GHSA-3wf2-2pq4-4rvc
• FIX: woodpecker-ci/woodpecker@8aa3e5e
• FIX: Disallow to set arbitrary environments for plugins woodpecker-ci/woodpecker#3909
• FIX: Add blocklist of environment variables who could alter execution of plugins woodpecker-ci/woodpecker#3934
• REPORT: Getting privileged permissions using a "dangerous" env var with a escalated plugin woodpecker-ci/woodpecker#3929

Cross references:
No existing reports found with this module or alias.
See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: go.woodpecker-ci.org/woodpecker
      vulnerable_at: 1.0.5
    - module: go.woodpecker-ci.org/woodpecker/v2
      versions:
        - fixed: 2.7.0
      vulnerable_at: 2.6.1
summary: |-
    Woodpecker's custom environment variables allow to alter execution flow of
    plugins in go.woodpecker-ci.org/woodpecker
cves:
    - CVE-2024-41122
ghsas:
    - GHSA-3wf2-2pq4-4rvc
references:
    - advisory: https://github.com/advisories/GHSA-3wf2-2pq4-4rvc
    - advisory: https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-3wf2-2pq4-4rvc
    - fix: https://github.com/woodpecker-ci/woodpecker/commit/8aa3e5ec82c92eca3279e4be68625111eeedf1c4
    - fix: https://github.com/woodpecker-ci/woodpecker/pull/3909
    - fix: https://github.com/woodpecker-ci/woodpecker/pull/3934
    - report: https://github.com/woodpecker-ci/woodpecker/issues/3929
source:
    id: GHSA-3wf2-2pq4-4rvc
    created: 2024-07-19T20:01:19.817311319Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/601383 mentions this issue: data/reports: add GO-2024-2998

[gopherbot]

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports