PT-2022-19437 · Thoughtworks · Gocd

Published 2022-05-20 · Updated 2022-06-06 · CVE-2022-29184

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 22.1.0

Description GoCD is a continuous delivery server. In versions prior to 22.1.0, existing authenticated users with permissions to edit or create pipeline materials or pipeline configuration repositories can get remote code execution capability on the GoCD server via configuring a malicious branch name, which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existing GoCD administration permissions to either create/edit (hg-based) configuration repositories, create/edit pipelines and their (hg-based) materials, or commit malicious configuration to an external repository.

Recommendations For GoCD versions prior to 22.1.0, update to version 22.1.0 to resolve the issue. As a temporary workaround, users who do not use/rely upon Mercurial materials can uninstall/remove the hg/Mercurial binary from the underlying GoCD Server operating system or Docker image.

Exploit

Fix

Argument Injection

Command Injection

Weakness Enumeration

CWE-88

CWE-77

Related Identifiers

CVE-2022-29184

GHSA-VF5R-R7J2-CF2H

Affected Products

Gocd

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29184.json · Exploit
• https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb · Patch
• https://osv.dev/vulnerability/CVE-2022-29184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29184 · Security Note
• https://gocd.org/releases/#22-1-0 · Vendor Advisory
• https://github.com/gocd/gocd/releases/tag/22.1.0 · Note
• https://github.com/gocd/gocd/security/advisories/GHSA-vf5r-r7j2-cf2h · Note
• https://t.me/cvenotify/31165 · Telegram Post
• https://t.me/cibsecurity/43097 · Telegram Post