CVE-2022-24832

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.
References
Link Resource
https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authentication Vendor Advisory
https://github.com/gocd/gocd-ldap-authentication-plugin Product Third Party Advisory
https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3 Patch Third Party Advisory
https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144 Release Notes Third Party Advisory
https://github.com/gocd/gocd/pull/10244 Patch Third Party Advisory
https://github.com/gocd/gocd/releases/tag/22.1.0 Release Notes Third Party Advisory
https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3h Third Party Advisory
https://www.gocd.org/releases/#22-1-0 Release Notes Vendor Advisory
https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authentication Vendor Advisory
https://github.com/gocd/gocd-ldap-authentication-plugin Product Third Party Advisory
https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3 Patch Third Party Advisory
https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144 Release Notes Third Party Advisory
https://github.com/gocd/gocd/pull/10244 Patch Third Party Advisory
https://github.com/gocd/gocd/releases/tag/22.1.0 Release Notes Third Party Advisory
https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3h Third Party Advisory
https://www.gocd.org/releases/#22-1-0 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:thoughtworks:gocd:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:51

Type Values Removed Values Added
References () https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authentication - Vendor Advisory () https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authentication - Vendor Advisory
References () https://github.com/gocd/gocd-ldap-authentication-plugin - Product, Third Party Advisory () https://github.com/gocd/gocd-ldap-authentication-plugin - Product, Third Party Advisory
References () https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3 - Patch, Third Party Advisory () https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3 - Patch, Third Party Advisory
References () https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144 - Release Notes, Third Party Advisory () https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144 - Release Notes, Third Party Advisory
References () https://github.com/gocd/gocd/pull/10244 - Patch, Third Party Advisory () https://github.com/gocd/gocd/pull/10244 - Patch, Third Party Advisory
References () https://github.com/gocd/gocd/releases/tag/22.1.0 - Release Notes, Third Party Advisory () https://github.com/gocd/gocd/releases/tag/22.1.0 - Release Notes, Third Party Advisory
References () https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3h - Third Party Advisory () https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3h - Third Party Advisory
References () https://www.gocd.org/releases/#22-1-0 - Release Notes, Vendor Advisory () https://www.gocd.org/releases/#22-1-0 - Release Notes, Vendor Advisory
CVSS v2 : 4.9
v3 : 6.8
v2 : 4.9
v3 : 8.2

Information

Published : 2022-04-11 21:15

Updated : 2024-11-21 06:51


NVD link : CVE-2022-24832

Mitre link : CVE-2022-24832

CVE.ORG link : CVE-2022-24832


JSON object : View

Products Affected

thoughtworks

  • gocd
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')