x/vulndb: potential Go vuln in go.woodpecker-ci.org/woodpecker: GHSA-xw35-rrcp-g7xm

[GoVulnBot]

Advisory GHSA-xw35-rrcp-g7xm references a vulnerability in the following Go modules:

Module
go.woodpecker-ci.org/woodpecker
go.woodpecker-ci.org/woodpecker/v2

Description:

Impact

The server allow to create any user who can trigger a pipeline run malicious workflows:

• Those workflows can either lead to a host takeover that runs the agent executing the workflow.
• Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are overwritten.

Patches

woodpecker-ci/woodpecker#3933

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?
Enable the "gated" repo feature and review each change upfront

References

• https://github.com/woodpecker-ci/wood...

References:

• ADVISORY: GHSA-xw35-rrcp-g7xm
• ADVISORY: GHSA-xw35-rrcp-g7xm
• FIX: woodpecker-ci/woodpecker@764329e
• FIX: Make sure plugins only mount the workspace base in a predefinde location woodpecker-ci/woodpecker#3933
• REPORT: Getting "privileged permissions" / "secrets value" by using (... an escalated plugin and/) by adjusting workspace woodpecker-ci/woodpecker#3924

Cross references:
No existing reports found with this module or alias.
See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: go.woodpecker-ci.org/woodpecker
      vulnerable_at: 1.0.5
    - module: go.woodpecker-ci.org/woodpecker/v2
      versions:
        - fixed: 2.7.0
      vulnerable_at: 2.6.1
summary: Woodpecker's custom workspace allow to overwrite plugin entrypoint executable in go.woodpecker-ci.org/woodpecker
cves:
    - CVE-2024-41121
ghsas:
    - GHSA-xw35-rrcp-g7xm
references:
    - advisory: https://github.com/advisories/GHSA-xw35-rrcp-g7xm
    - advisory: https://github.com/woodpecker-ci/woodpecker/security/advisories/GHSA-xw35-rrcp-g7xm
    - fix: https://github.com/woodpecker-ci/woodpecker/commit/764329ed1dbc47c4a517ccc749e3feb34059fac8
    - fix: https://github.com/woodpecker-ci/woodpecker/pull/3933
    - report: https://github.com/woodpecker-ci/woodpecker/issues/3924
source:
    id: GHSA-xw35-rrcp-g7xm
    created: 2024-07-19T20:01:20.387548324Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/601382 mentions this issue: data/reports: add GO-2024-2999

[gopherbot]

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports