CVE-2021-39132
Description
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14
How to fix
- pagerduty rundeck3.3.14, 3.4.3 or later
- org.rundeck:rundeck-core3.4.3, 3.3.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pagerduty rundeck | v < 3.3.14, 3.4.0 ≤ v < 3.4.3 | 3.3.14, 3.4.3 |
| org.rundeck:rundeck-coreMaven | 3.4.0 ≤ v < 3.4.3, v < 3.3.14 | 3.4.3, 3.3.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.