CVE-2021-43287 — AI Deep Analysis Summary

🚨 **Essence**: A critical info leak & RCE in GoCD. 📉 **Consequences**: Attackers can execute arbitrary code and steal secrets/keys via command injection in Git URL testing. 💥

🛡️ **Root Cause**: Command Injection. 🐛 **Flaw**: The Git URL 'Test Connection' feature fails to sanitize inputs, allowing malicious commands to run on the server. ⚠️

🎯 **Affected**: ThoughtWorks GoCD. 📅 **Versions**: All versions **prior to 21.3.0**. 📦 **Component**: CI/CD Server pipeline creation module. 🔍

🕵️ **Hackers Can**: Execute arbitrary OS commands. 📂 **Data Access**: Read arbitrary files, leak build secrets, and steal encryption keys. 🔑

⚖️ **Threshold**: Medium. 🔐 **Auth**: Requires ability to **create new pipelines** on the server. 🚪 **Config**: No unauthenticated access needed; needs basic pipeline creation rights. 📝

💣 **Public Exp**: YES. 📜 **PoC/EXP**: Available on GitHub (Wrin9) and Nuclei templates. 🚀 **Status**: Active exploitation tools exist for file read and command execution. 💻

🔍 **Self-Check**: Use Nuclei templates or PoC scripts. 📡 **Scan**: Target the Git URL 'Test Connection' endpoint. 🧪 **Verify**: Check for command output or file content leakage. 📋

✅ **Fixed**: YES. 🛠️ **Patch**: Upgrade to **GoCD 21.3.0** or later. 📥 **Source**: Official release notes and GitHub commits confirm the fix. 📝

🚧 **No Patch?**: Restrict pipeline creation permissions. 🚫 **Mitigation**: Block external Git URL testing or isolate the server. 🛡️ **Action**: Limit network access to GoCD admin interfaces. 🔒

🔥 **Urgency**: HIGH. 🚨 **Priority**: Critical. ⚡ **Reason**: Easy to exploit, leads to full server compromise & data theft. 🏃 **Action**: Patch immediately! 🏃‍♂️