GHSA-4gcf-5m39-98mc

Woodpecker does not validate webhook before changing any data

Source: GitHub Advisory Database (reviewed) High CVE-2023-40034

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/woodpecker-ci/woodpecker	>= 1.0.0, < 1.0.2	1.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository. This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage. ### Patches Please use either next or the latest v1.0 e.g. v1.0.2 ### Workarounds Secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall. ### References Fix: https://github.com/woodpecker-ci/woodpecker/pull/2221 Backport: https://github.com/woodpecker-ci/woodpecker/pull/2222

References

External links from the advisory. They lead to third-party sites.