CyberRota Analysis
AI-GeneratedThe vulnerability affects OpenChoreo, an open-source developer platform for Kubernetes, allowing unauthenticated build triggers via the POST /api/v1alpha1/autobuild endpoint due to improper validation of the X-Event-Key and lack of HMAC-SHA256 verification for Bitbucket requests. This could enable attackers to initiate builds with arbitrary commit SHAs, potentially leading to unauthorized code execution or deployment. Organizations using affected versions should prioritize upgrading to versions 1.0.3, 1.1.3, or 1.2.0-rc.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2.