Description
OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | BuildPiper | < 2.7.0 | 2.7.0 |
References
- https://gist.github.com/neelkotnis/2c7f64bebb810f565223b6916551df36 technical-description exploit
- BuildPiper Product Page product
- VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API third-party-advisory