Otterdog Webapp Format String Eval via GitHub Webhook

Executive Summary

This vulnerability is a critical unauthenticated remote code execution flaw in the otterdog webapp. It occurs when the GITHUB_WEBHOOK_SECRET configuration is unset or empty, bypassing HMAC signature verification. The webapp evaluates a format-string built from attacker-controlled input in the GitHub webhook JSON body using Python's eval(), allowing arbitrary code execution on the host system.

Useful 0 Not Useful 0

Detection Guidance

Check if the otterdog webapp is running and if the GITHUB_WEBHOOK_SECRET is configured. Inspect network traffic for POST requests to /github-webhook/receive without HMAC validation. Look for eval() usage in github_webhook.py handling GitHub webhook JSON input.

Useful 0 Not Useful 0

Impact Analysis

An attacker can send malicious input to the POST /github-webhook/receive endpoint, which is accessible without authentication when the secret is missing. This allows them to execute arbitrary Python code on the webapp host, potentially leading to full system compromise, data theft, or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security due to unauthorized code execution. It could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality principles and HIPAA's security rule for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately set a non-empty GITHUB_WEBHOOK_SECRET and enforce its presence at startup. Replace eval() with safe dictionary lookups for input handling. Block unauthenticated POST requests to /github-webhook/receive until patched.

Useful 0 Not Useful 0