CVE-2024-41122: 
vulnerability analysis and mitigation

Woodpecker, a CI/CD engine, was found to contain a security vulnerability (CVE-2024-41122) that allows any user to trigger pipeline runs with malicious workflows. The vulnerability was discovered in versions prior to 2.7.0 and was disclosed on July 19, 2024. The issue affects the server component of Woodpecker and could potentially lead to host takeover or secret extraction (GitHub Advisory).

The vulnerability has a CVSS v3.1 base score of 8.8 HIGH (NIST) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue allows malicious workflows to either take over the host running the agent executing the workflow or extract secrets that would normally be provided to plugins whose entrypoint are overwritten (NVD).

The vulnerability has two main impact vectors: 1) Host takeover of the agent executing the workflow, potentially compromising the entire CI/CD infrastructure, and 2) Extraction of sensitive secrets that are normally provided to plugins, leading to potential credential theft and unauthorized access (GitHub Advisory).

The vulnerability requires low privileges and no user interaction to exploit, though it needs network access to the Woodpecker server. Any user with access to create pipelines could potentially exploit this vulnerability to execute malicious workflows (NVD).

The vulnerability has been patched in version 2.7.0, and users are strongly advised to upgrade. For those unable to upgrade immediately, enabling the 'gated' repository feature and reviewing each change before running pipelines can serve as a temporary mitigation measure (GitHub Advisory).