Remote Code Execution Vulnerability in Otterdog Webapp

• •Otterdog webapp vulnerable to RCE via GitHub webhook without GITHUB_WEBHOOK_SECRET.
• •All versions of Otterdog are affected; no patch has been released yet.
• •Attackers can execute arbitrary Python code on the server if the secret is not configured.

The Otterdog web application is vulnerable to unauthenticated remote code execution due to improper handling of the GITHUB_WEBHOOK_SECRET configuration. When this secret is unset or empty, the application skips HMAC signature verification, allowing attackers to send malicious payloads to the webhook endpoint. This vulnerability affects all versions of the Otterdog webapp, which can be deployed from source or via container. The flaw is present in the eval() function that processes incoming GitHub webhook JSON data, enabling arbitrary code execution on the host. The vulnerability has been assigned CWE-95 for eval injection. As of now, there is no patch available, and the issue remains unaddressed. Security professionals are advised to ensure the GITHUB_WEBHOOK_SECRET is set to prevent exploitation.