CVE-2021-39133
published 2021-08-30CVE-2021-39133: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with…
PriorityP430medium6.8CVSS 3.1
AVNACLPRHUIRSUCHIHAH
EPSS
0.45%
36.1th percentile
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| pagerduty | rundeck | < 3.3.14 | 3.3.14 |
| pagerduty | rundeck | >= 3.4.0 < 3.4.3 | 3.4.3 |
| rundeck | rundeck | < 3.3.14 | 3.3.14 |
| rundeck | rundeck | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
ghsa·2021-09-01
CVE-2021-39133 [HIGH] CWE-352 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
### Impact
A user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.
### Patches
Available in Rundeck 3.4.3 and 3.3.14
### Workarounds
Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.
### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])
To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
OSV
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
osv·2021-09-01
CVE-2021-39133 [HIGH] Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
### Impact
A user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.
### Patches
Available in Rundeck 3.4.3 and 3.3.14
### Workarounds
Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.
### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])
To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426chttps://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9https://github.com/rundeck/rundeck/security/advisories/GHSA-3jmw-c69h-426c
2021-08-30
Published