Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.16.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0.
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- CVE published
- Record last updated
Affected versions
- woodpecker-ci woodpecker
From 1.0.0 · fixed in 3.16.0
- github.com/woodpecker-ci/woodpeckerGo
From 1.0.0
- go.woodpecker-ci.org/woodpeckerGo
All versions
- go.woodpecker-ci.org/woodpecker/v2Go
All versions
- go.woodpecker-ci.org/woodpecker/v3Go
fixed in 3.16.0
- github.com/woodpecker-ci/woodpeckerGo
From 1.0.0 · through 1.0.4
- go.woodpecker-ci.org/woodpecker/v2Go
through 2.8.3