Vela Insecure Defaults
Date: 2022-11
Affected: go/github.com/go-vela/worker, go/github.com/go-vela/server
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-39395
CWE: CWE-269
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

### Impact Some current default configurations for Vela allow exploitation and container breakouts. #### Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fresh install of Vela without any additional configuration, the `target/vela-docker` plugin will run as a privileged container, even if the Vela administrators did not intend to allow for any privileged plugins, and even if the `vela.yml` configuration file does not use the `privileged = True` flag. Privileged containers permit trivial breakouts, which can pose significant risk to the environment in which Vela is running. #### Default Allowed Repositories On a fresh install of Vela, anyone with a GitHub account (or other enabled source control management solution) is allowed to enable a repository within Vela and run builds. This means that, if a Vela instance is accessible to the public, a third party could add their own malicious repos to the Vela instance and run arbitrary code. An example of a publicly accessible Vela instance would be one not protected behind a VPN. Whether Vela is publicly accessible depends on how Vela is set up, NOT how it is connected to GitHub. #### Default Enabled Events allows Pull Requests By default, Vela currently enables pull request events when a repository is Vela-enabled. Unless this default was changed when enabling each repository, a


Mitigations:

Architectural layers (MAESTRO):