PT-2022-24893 · Gocd+1 · Gocd+1

Published 2022-10-14 · Updated 2022-10-19 · CVE-2022-39311

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 21.1.0

Description GoCD is a continuous delivery server that automates and streamlines the build-test-release cycle for continuous delivery of a product. The issue allows remote code execution on the server from a malicious or compromised agent due to the exposure of the Spring RemoteInvocation endpoint, which enables deserialization of arbitrary Java objects. Exploitation requires agent-level authentication, meaning an attacker would need to compromise an existing agent, its network communication, or register a new agent to exploit this issue.

Recommendations For versions prior to 21.1.0, update to GoCD version 21.1.0 to resolve the issue. As a temporary workaround, consider restricting agent registrations and monitoring agent communications to minimize the risk of exploitation. Avoid using the Spring RemoteInvocation endpoint until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-39311

GHSA-2HJH-3P3P-8HCM

Affected Products

Gocd

Spring Remoteinvocation

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39311.json · Exploit
• https://github.com/gocd/gocd/commit/7b88b70d6f7f429562d5cab49a80ea856e34cdc8 · Patch
• https://github.com/gocd/gocd/security/advisories/GHSA-2hjh-3p3p-8hcm · Patch
• https://osv.dev/vulnerability/CVE-2022-39311 · Vendor Advisory
• https://gocd.org/releases/#21-1-0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39311 · Security Note
• https://t.me/cibsecurity/51511 · Telegram Post