// For flags

CVE-2022-39311

Compromised agents may be able to execute remote code on GoCD Server

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 are vulnerable to remote code execution on the server from a malicious or compromised agent. The Spring RemoteInvocation endpoint exposed agent communication and allowed deserialization of arbitrary java objects, as well as subsequent remote code execution. Exploitation requires agent-level authentication, thus an attacker would need to either compromise an existing agent, its network communication or register a new agent to practically exploit this vulnerability. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.

GoCD es un servidor de entrega continua. GoCD le ayuda a automatizar y agilizar el ciclo de construcción-prueba-lanzamiento para la entrega continua de su producto. Las versiones de GoCD anteriores a la 21.1.0 son vulnerables a la ejecución remota de código en el servidor desde un agente malicioso o comprometido. El endpoint de Spring RemoteInvocation exponía la comunicación con el agente y permitía la deserialización de objetos java arbitrarios, así como la posterior ejecución de código remoto. La explotación requiere autenticación a nivel de agente, por lo que un atacante necesitaría comprometer un agente existente, su comunicación de red o registrar un nuevo agente para explotar prácticamente esta vulnerabilidad. Este problema ha sido corregido en GoCD versión 21.1.0. Actualmente no se presentan mitigaciones conocidas

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-02 CVE Reserved
  • 2022-10-14 CVE Published
  • 2024-08-02 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Thoughtworks
Search vendor "Thoughtworks"
 Gocd
Search vendor "Thoughtworks" for product "Gocd"
 < 21.1.0
Search vendor "Thoughtworks" for product "Gocd" and version " < 21.1.0"
-
Affected