CVE-2021-43289
📋 TL;DR
This vulnerability allows an attacker who has compromised a GoCD agent to upload malicious files to arbitrary directories on the GoCD server, though they cannot control the filename. This affects all GoCD installations before version 21.3.0 where agents communicate with the server.
💻 Affected Systems
- ThoughtWorks GoCD
📦 What is this software?
Gocd by Thoughtworks
⚠️ Risk & Real-World Impact
Worst Case
An attacker could upload malicious scripts or binaries to critical system directories, potentially leading to remote code execution, data exfiltration, or complete server compromise.
Likely Case
Attackers could upload malicious files to sensitive directories, enabling persistence, privilege escalation, or lateral movement within the GoCD infrastructure.
If Mitigated
With proper network segmentation and agent security controls, impact would be limited to the compromised agent's permissions and isolated network segments.
🎯 Exploit Status
Exploitation requires first compromising a GoCD agent. The vulnerability chain is documented in public research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.3.0 and later
Vendor Advisory: https://www.gocd.org/releases/#21-3-0
Restart Required: Yes
Instructions:
1. Backup your GoCD configuration and data. 2. Download GoCD 21.3.0 or later from official sources. 3. Stop the GoCD service. 4. Install the new version following vendor instructions. 5. Restart the GoCD service. 6. Verify all agents are updated and functioning.
🔧 Temporary Workarounds
Network Segmentation
allIsolate GoCD agents from sensitive server directories using network controls
Agent Security Hardening
allImplement strict access controls and monitoring on GoCD agents
🧯 If You Can't Patch
- Implement strict network segmentation between GoCD agents and servers
- Enhance monitoring and alerting for unusual file upload activities
🔍 How to Verify
Check if Vulnerable:
Check GoCD server version. If version is below 21.3.0, the system is vulnerable.Check Version:
gocd-server --version or check server web interfaceVerify Fix Applied:
Verify GoCD server version is 21.3.0 or higher and test agent-server file transfer functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns from agents
- Files appearing in unexpected server directories
- Agent authentication anomalies
Network Indicators:
- Unusual file transfer patterns between agents and server
- Unexpected outbound connections from GoCD server
SIEM Query:
source="gocd" AND (event="file_upload" OR event="agent_communication") AND status="unusual"🔗 References
- https://blog.sonarsource.com/gocd-vulnerability-chain
- https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595
- https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f
- https://www.gocd.org/releases/#21-3-0
- https://blog.sonarsource.com/gocd-vulnerability-chain
- https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595
- https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f
- https://www.gocd.org/releases/#21-3-0
