Critical flaw in GoCD provides platform for supply chain attacks

guest · Oct 28, 2021

Critical flaw in GoCD provides platform for supply chain attacks
Vulnerability in software used by Fortune 500 firms raises fears of SolarWinds-like impact
October 28, 2021
https://portswigger.net/daily-swig/critical-flaw-in-gocd-provides-platform-for-supply-chain-attacks

A critical vulnerability in popular CI/CD tool GoCD could allow unauthenticated attackers to extract encrypted secrets and poison software build processes – potentially paving the way to supply chain attacks.

The maintainers of the open source, Java-built platform have addressed the arbitrary file read flaw along with several other bugs discovered by Swiss security firm SonarSource.
Miscreants who abuse the vulnerability could take over GoCD servers and execute arbitrary code, as well as impersonate GoCD agents and seize control of software delivery pipelines.
Click to expand...

SolarWinds-style threat
“Attackers could leak API keys to external services such as Docker Hub and GitHub, steal private source code, get access to production environments, and overwrite files that are being produced as part of the build processes,” said SonarSource security researcher Simon Scannell in a blog post.

The lack of public data on how widely GoCD is used makes it hard to gauge the impact of a hypothetical supply chain attack, Scannell tells The Daily Swig, “but we know that it is used by Fortune 500 companies”.
He adds:

“An attacker who has compromised a CI/CD pipeline can push malicious code into anything the pipeline produces – for example Docker images, JAR files, executables, libraries, etc.
Click to expand...

SonarSource: Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD

GoCD, written in Java, is a popular CI/CD solution with a large range of users from NGOs to Fortune 500 companies with billions of dollars in revenue. Naturally, this makes it a critical piece of infrastructure and an extremely attractive target for attackers. In order to automate build and release processes, a centralized CI/CD solution has access to various production environments and private source code repositories.

With so much trust and responsibility placed in CI/CD solutions, a compromise of any part of the software delivery pipeline would be detrimental to a company running GoCD.
Click to expand...

We rate the vulnerability presented in this blog post as highly critical, since an unauthenticated attacker can extract all tokens and secrets used in all build pipelines.
Click to expand...

guest · Nov 11, 2021

GoCD bug chain provides second springboard to supply chain attacks
Follow-up to recent GoCD disclosure provides additional path to infiltrating build environments
November 11, 2021
https://portswigger.net/daily-swig/...es-second-springboard-to-supply-chain-attacks

The maintainers of GoCD, a widely used, open source tool that automates the continuous delivery (CD) of software, have addressed three vulnerabilities that, if chained, could lead to the underlying server being taken over.

The security flaws – comprising CVE-2021-43288, CVE-2021-43286, and CVE-2021-43289 – were discovered by Simon Scannell and Thomas Chauchefoin of SonarSource.

“An attacker who successfully exploits these vulnerabilities can leak intellectual property, modify source code, gain access to production environments, and backdoor any software that the CI/CD server produces,” Scannell and Chauchefoin tell The Daily Swig.
“As a result, attackers could launch supply chain attacks.”
Click to expand...

The first of the additional vulnerabilities is a stored cross-site scripting (XSS) bug that allows attackers to impersonate administrators visiting a malicious job status page, allowing security-sensitive actions to be secretly performed.

The following two could then be chained with the first to fully compromise the targeted instance.
Click to expand...

Log in or Sign up

Critical flaw in GoCD provides platform for supply chain attacks

guest Guest

guest Guest

Log in or Sign up

Critical flaw in GoCD provides platform for supply chain attacks

guest Guest

guest Guest

Useful Searches