PT-2021-23352 · Gradle · Gradle Enterprise+1

Jonathan Leitschuh · Published 2021-10-27 · Updated 2021-11-03 · CVE-2021-41589

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2021.3 Enterprise Build Cache Node versions prior to 10.0

Description The issue concerns potential cache poisoning and remote code execution when running the build cache node with its default configuration, which allows anonymous access to the configuration user interface and anonymous write access to the build cache. A malicious actor with network access can populate the cache with manipulated entries that may execute malicious code as part of a build process. This applies to both the build cache provided with Gradle Enterprise and the separate build cache node service.

Recommendations For Gradle Enterprise versions prior to 2021.3, update to version 2021.3 or later to resolve the issue. For Enterprise Build Cache Node versions prior to 10.0, update to version 10.0 or later to resolve the issue. As a temporary workaround, consider changing the default open configuration to restrict access to the build cache and the configuration user interface to prevent anonymous access and potential cache poisoning.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-41589

Affected Products

Enterprise Build Cache Node

Gradle Enterprise

References · 7

• https://security.gradle.com/advisory/2021-06 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41589 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41589 · Vendor Advisory
• https://security.gradle.com · Vendor Advisory
• https://t.me/cibsecurity/31278 · Telegram Post
• https://t.me/cvenotify/22934 · Telegram Post
• https://t.me/cvenotify/22474 · Telegram Post