PT-2022-24889 · Gocd · Gocd

Published 2022-10-14 · Updated 2023-07-14 · CVE-2022-39308

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoCD versions 19.2.0 through 19.10.0

Description The issue concerns a timing attack in the validation of access tokens due to the use of regular string comparison instead of a constant time algorithm. This could allow a brute force attack on GoCD server API calls to observe timing differences in validations and guess an access token generated by a user for API access.

Recommendations For GoCD versions 19.2.0 through 19.10.0, apply rate limiting or insert random delays to API calls made to the GoCD Server via a reverse proxy or other fronting web server as a workaround. Alternatively, disallow the use of access tokens by having an administrator revoke all access tokens through the "Access Token Management" admin function. Update to GoCD version 19.11.0 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-1254

CWE-208

CWE-697

Related Identifiers

CVE-2022-39308

GHSA-999P-FP84-JCPQ

Affected Products

Gocd

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39308.json · Exploit
• https://github.com/gocd/gocd/commit/236d4baf92e6607f2841c151c855adcc477238b8 · Patch
• https://gocd.org/releases/#19-11-0 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39308 · Security Note
• https://github.com/gocd/gocd/security/advisories/GHSA-999p-fp84-jcpq · Note
• https://github.com/gocd/gocd/releases/tag/19.11.0 · Note
• https://t.me/cibsecurity/51500 · Telegram Post